initial tpm broker

docs/fleet-management-design.md

@@ -44,6 +44,13 @@ endpoint; the server authenticates the host by cert CN/SAN, which is the canonic
 fleet identity (= NVMe hostnqn = 802.1X identity). Reuses the **step-ca fleet CA**
 (`serving/dot1x-bench/`). No baked secret; the host also pins the server cert.
 
+> **Bootstrap (where the cert comes from):** mTLS here assumes the host already
+> holds a TPM cert — but an un-enrolled host does not. That chicken-and-egg is
+> resolved by **enrolment**, which is the management plane's *one* unauthenticated
+> endpoint and the moment the inventory record is born. See
+> **[tpm-enrolment-design.md](tpm-enrolment-design.md)** — the enrolment broker is
+> designed to fold into this mgmt service as its bootstrap routes.
+
 - **Secure path:** full mTLS, TPM cert. Strong, no secrets in the image.
 - **Open/test path (`rd.dot1x=0`):** fall back to dnsmasq fleet-name + MAC as a
   weak identity. **Lab only** — flagged as insufficient for production.
@@ -181,6 +188,14 @@ bus) already exist.
 
 - **Telemetry encoding:** structured syslog/JSON into Wazuh (Phase 1) vs native
   OTLP from the start. Leaning Wazuh-first for reuse.
+- **Steady-state transport (agent ↔ manager):** the agent is **Go**, the path is
+  **mTLS + host-dialed** (preserves "no inbound port"). Fork: bespoke **gRPC**
+  stream (health up / desired-state down) vs reuse **OTLP-gRPC for metrics + Wazuh
+  for events** + a thin gRPC control stream — the latter gets VictoriaMetrics/
+  Grafana/Wazuh for free. `Connect` (connectrpc.com) if one protobuf IDL serving
+  gRPC + JSON + browser is wanted. Note **enrolment** deliberately stays plain
+  HTTP/JSON (stdlib, minimal, the one unauth edge) — see
+  [tpm-enrolment-design.md](tpm-enrolment-design.md) "Implementation".
 - **Metrics store:** VictoriaMetrics vs Prometheus (VM is lighter for push +
   long retention).
 - **Desired-state store:** git (GitOps, aud/rollback for free, matches the