Update SSP

docs/design-v2-errata.md

@@ -4,7 +4,7 @@ Records where the as-built implementation diverges from
 `diskless-fleet-design-v2.pdf`. The PDF remains authoritative for the
 architecture; this note captures deltas discovered bringing the build up on
 **Rocky 9.8** until they are folded into a consolidated **v3**. Last updated
-2026-06-15.
+2026-06-22.
 
 The architecture is unchanged: 802.1X EAP-TLS with a TPM-held key, MACsec on the
 access link, dm-verity-protected erofs root over NVMe/TCP, signed UKI, and the
@@ -57,6 +57,43 @@ indices shift with the transient discovery controller.
 [../serving/spdk-setup.sh](../serving/spdk-setup.sh) (2nd bdev/namespace), and
 CLAUDE.md invariant #9.
 
+## 1c. Design-level addition — pre-auth boot path & per-host identity enrolment
+
+Two design points the PDF leaves implicit; both are load-bearing for the secure
+model and are recorded here pending v3.
+
+**The boot path is inherently pre-auth, so a pre-auth permit-set is mandatory.**
+The firmware (UEFI HTTP boot / PXE→iPXE) fetches the UKI **before** any OS or
+supplicant exists — there is no firmware 802.1X supplicant — so the UKI/initramfs
+fetch always happens in the unauthenticated state. The secure model therefore
+requires the authenticator to permit a *scoped* set of services pre-auth
+(DHCP/DNS + TFTP + HTTP to the serving host) and only complete 802.1X once the
+**OS** is running; RADIUS returns the secure VLAN on Access-Accept, after which
+DHCP-for-the-running-system and the NVMe/TCP root ride **`macsec0`** (post-auth,
+encrypted). Mechanism on a real switch: low-impact 802.1X / a pre-auth dACL /
+boot→secure dynamic VLAN. Consequences:
+- Pre-auth traffic has **no MACsec** (plaintext at L2). Integrity of the boot
+  therefore comes from **Secure Boot** (the signed UKI + signed `fleet-ipxe`), not
+  the network — this is *why* signing matters: the boot transport is untrusted.
+- `hostapd` wired (the bench authenticator) is strictly port-based and can't model
+  a pre-auth per-flow permit — the in-place pre-auth ACL is a real-switch feature,
+  validated on the 820's switch, not the VM rig (see `serving/dot1x-bench/`).
+
+**Per-host 802.1X identity is created by an enrolment flow, never baked in**
+(invariant #1). Chosen pattern: **trust-on-first-use with out-of-band fingerprint
+approval** — on an empty TPM the host generates a key *in* the TPM
+(`0x81010001`), submits a CSR to an enrolment **broker** (reachable via the same
+pre-auth permit-set, e.g. an `/enrol/` location on the serving nginx → broker →
+step-ca signer), and shows a fingerprint on the Plymouth splash; an admin
+cross-checks it and approves; the signed cert is written to NV `0x01800001` and
+authentication proceeds. Enrol triggers on **empty-NV only** (expired cert →
+automatic renew; auth-failure-with-cert → alert, not re-enrol). The fingerprint
+authorises *which device*; **TPM attestation** (step-ca ACME `device-attest-01`)
+proves *key residency* — use both for full assurance. Runs in a provisioning
+UKI/mode, not the production initramfs. Full design + decisions: **TODO #11** (the
+network-identity counterpart to **#10**, which enrols Secure Boot PK/KEK/db; both
+share the provisioning-UKI vehicle).
+
 ## 2. Implementation notes (not architectural)
 
 These don't contradict the PDF (it doesn't specify them) but are worth recording.