docs(files): document pinned SMB validation

2026-08-21 23:20:15 +02:00
parent 378f4d6ac5
commit 62047e7a20
2 changed files with 24 additions and 6 deletions
@@ -1034,6 +1034,16 @@ attempt. Botocore retries, redirects, endpoint discovery, and aliases, plus SMB
 reconnects and DFS referrals, must pass through the pinned factories. A changed
 or unsupported SDK seam must fail before a usable client/session is returned.

+SMB deployments use `smbprotocol>=1.13`; signing is required by default and SMB
+encryption can be required per connector profile. Private targets additionally
+require the governed private-network setting, but that setting never bypasses
+per-connection address validation. The bundled development Samba target checks
+live initial browse/import behavior with `smoke.py --require-smb`. It is a
+single-share fixture rather than a DFS topology: reconnect and referral handling
+is enforced by the transport contract suite, while operators using DFS must run
+the same required smoke check against their institutional referral topology and
+record the initial and referred peers as deployment evidence.
+
 ### Imported evidence and sync

 Given a permitted WebDAV file is imported, its managed response and audit event