[#3918 sub-issue][SQL Server][3/3] Verified TLS connector and receiver activation #4361

Pre-filing checklist

• I searched existing issues and didn't find a duplicate

Component(s)

Rust OTAP dataflow (rust/otap-dataflow/), SQL Server receiver registration, TLS, authentication capability wiring, documentation, and CI/build integration.

Objective

Complete the three-PR sequence by making urn:otel:receiver:sql_server runnable behind the independently enabled sql-server feature.

Result of this layer: an experimental receiver that polls SQL Server over verified TLS, emits structured OTLP logs, and resumes from acknowledged file checkpoints.

Rationale

Keep public activation together with its transport, operational safeguards, live evidence, and operator guidance. Avoid registering a placeholder receiver before the actual connection and delivery path exists.

Scope

• Implement the SQL Server connector using the published Tiberius native-TLS configuration selected in Part 2: OpenSSL on Linux and Schannel on Windows. Default to verified TLS with platform roots and optional connection-local ca_file and server_name_override. The override changes the TLS verification identity, not the connection address. Let Tiberius perform TDS prelogin and TLS framing; do not add a separate generic TLS wrapper around the TCP connection.
• Preserve explicit controlled-testing modes: non-TLS operation through enabled: false, subject to server policy, and certificate-chain/hostname bypass through trust_server_certificate: true. Reject contradictory settings, emit redacted warnings for unsafe modes, and resolve the bypass-plus-SNI override behavior explicitly before activation. Leave other database receivers unchanged.
• Keep synchronous certificate loading and native connector setup off the local pipeline executor through bounded, owned connection work. Credential acquisition and connection setup share one absolute deadline. A dropped connection future must not orphan setup work; connector shutdown must confirm owned work has stopped before source ownership can be released. A timeout around blocking work alone is not confirmation that it stopped.
• Register the receiver factory, require BasicAuthProvider, enforce single-core placement, acquire shared checkpoint ownership, and bootstrap admission from process memory-pressure state.
• Forward the credential extension from the root feature and add component metadata/inventory registration.
• Add the pinned SQL Server 2022 fixture, isolated credentials/certificates, fixture prerequisite checks, and owned-resource cleanup.
• Add real-server tests, Linux live-integration CI, and Windows deterministic-test coverage; document native Windows live qualification separately.
• Provide a complete YAML example, permissions/TLS/setup guidance, the local demo walkthrough, operating limits, and the new-component changelog.
• Document and qualify native crypto deployment requirements, including Linux OpenSSL libraries, root stores, linking strategy, and update ownership. Inspect both the SQL Server driver dependency path and the complete intended production artifact; selecting native TLS for this receiver does not automatically remove Ring or other providers used by unrelated components.

Primary files: connector.rs, factory portions of mod.rs and tests.rs, live_tests.rs, component metadata/inventory, fixture scripts, workflows, the YAML example, README, and DEMO.md.

Acceptance Criteria

• The feature registers the documented URN; missing authentication capability and multicore placement fail explicitly.
• Default connections require verified native TLS. Invalid CA trust, expired certificates, and verification-name mismatches fail; valid replacement server certificates issued by the configured private CA succeed without changing global trust. Explicit SQL Server testing modes and server_name_override behave according to the agreed contract, contradictory options fail validation, and enabling a testing mode never silently changes secure defaults.
• Native-TLS tests exercise split-message and unconfirmed cancellation paths. The accepted containment discards uncertain sessions, returns no partial page from the failed operation, preserves its checkpoint and the ownership safeguard, and reports cleanup/shutdown failure without automatic reconnect. Tests do not treat socket closure as confirmation that server-side work ended.
• The actual Linux and Windows build/deployment dependency graphs and native library requirements are recorded, with applicable component-governance evidence. Native library selection is not represented as a complete compliance certification, and unrelated OTAP crypto-provider selections remain unchanged.
• The same live scenarios pass for Windows x64 and Linux x64 receivers against the pinned SQL Server 2022 Linux-container fixture: polling modes/type fidelity, TLS rejection, connection cancellation, and NACK/replay/ACK/restart.
• An actual engine run consumes the example configuration, emits rows, and installs acknowledged progress.
• Receiver operation requires no separately installed ODBC/JDBC driver, JVM, SQL tools, or native database client. Fixture tools are documented as developer-only prerequisites, not customer requirements.
• Live tests fail rather than silently skip when explicitly requested without their fixture; cleanup targets only owned resources and does not upload secrets.
• Documentation explains conditional at-least-once delivery, one active poller per source range, stop-before-start replacement, and experimental limitations. It explicitly describes the accepted availability cost of unconfirmed cancellation: receiver stoppage, possible ownership quarantine until process exit, and a safe operator-recovery procedure that does not assume process restart proves prior server work stopped.
• This PR merges after Parts 1 and 2; the final stack preserves the complete implementation and its coverage.

Dependencies or Blockers

Parent: #3918. Depends on Part 2: Tiberius adapter and shared-runtime integration (#4360), which depends on Part 1: Configuration and T-SQL query preparation (#4359). Uses the published Tiberius native-TLS dependency selected in Part 2. This receiver no longer depends on publication of the provider-neutral Rustls patch. The upstream split-message cancellation fix remains a tracked follow-up under the accepted fail-closed containment policy; qualifying that containment remains part of this issue.

Shared source coordination and exclusive-source rollout remain separate work: #4001 and #4049.

Additional Context