One HTTP client builder now decides where a read may connect. Under the jetstream path, DID documents, handles, profiles, registrations, records and pictures go over https to public addresses only (the metadata service on IPv4 and IPv6 included), through at most three redirects checked the same way; the deployment's own relay is read wherever it is, and `--private-addresses` lifts the guard for a development stack. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Change-Id: Ib32b13122678fff4ad46aacb5eba40015e8a9279