Merge remote-tracking branch 'origin/main' into poam-hardening

# Conflicts:
#	CLAUDE.md

docs/TODO.md

@@ -14,16 +14,32 @@ flipped back for a secure/production build (consolidated as item #8):
 - `nvmet_traddr` / CI `NVMET_TRADDR="192.168.50.10"` → hardcoded IP (should be a
   per-env DNS name like `nvme.fleet.lab` once DNS-at-boot is trusted).
 - Unsigned UKI (`sb_key`/`sb_cert` not passed) → Secure Boot must be OFF on the
-  test target. Production needs CI/HSM signing.
-- `enable_kiosk=true`; `boot_splash=true`; NTP via DHCP→serving-host chrony.
-- **`enable_stig` / CI `ENABLE_STIG="false"` RIGHT NOW** — temporarily disabled
-  to get a working box while the STIG regressions were diagnosed (now fixed,
-  below). **Flip back to `true`** and bench-verify the hardened build.
-- **`debug_shell=true` (DEBUG HOLE — passwordless root on tty2). REMOVE before
-  prod** (`-var debug_shell=false`). Note: it didn't actually come up on tty2 in
-  testing; diagnosis ended up done via offline `rootfs.erofs` mount + SMBIOS
-  `enforcing=0`. SMBIOS cmdline-extra works on Proxmox only after a full VM
-  **stop/start** (not `reset`).
+  test target. Production needs CI/HSM signing. **NOTE (2026-07-11, `poam-hardening`):
+  the main CI now fails closed** — a "Production build gate" aborts unless
+  `SB_KEY`/`SB_CERT`/`FLEET_CA` are set, so an unsigned/placeholder-CA build is no
+  longer producible via CI (only a local `packer build` without keys still yields
+  the lab warning). The `fleet-ipxe` build is gated the same way.
+- `enable_kiosk=true`; `boot_splash=true`.
+- **`secure_ntp` — DONE (2026-07-11, `secure-ntp`).** NTP is now **NTS
+  (CA-authenticated)** by default: the host verifies the serving NTP server's
+  fleet-signed NTS-KE cert against `radius-ca.pem` (closes F-03/P-18;
+  docs/secure-ntp-design.md). **No baked FQDN** — the NM dispatcher derives the
+  server name from the DHCP domain at runtime (`ntp.<domain>`), so a site-domain
+  change needs no rebuild. `secure_ntp=false` reverts to the legacy unauthenticated
+  DHCP option-42 path. Serving needs `serving/chrony/nts-cert.sh` (DNS SAN
+  `ntp.<domain>`), DHCP option-15 domain handout, + tcp/4460 open. **BENCH-VERIFY**
+  `chronyc -N authdata` (NTS cookies) + `$DHCP4_DOMAIN_NAME` populated.
+- **`enable_stig` — DONE (2026-07-11, `poam-hardening`).** CI `ENABLE_STIG="true"`
+  and, more importantly, the Packer template now **enforces** `enable_stig=true`
+  via variable validation — a build with it false fails `packer validate`/`build`.
+  There is no unhardened build path anymore. (Was temporarily off during the STIG
+  regression diagnosis; that escape hatch is gone.)
+- **`debug_shell` — REMOVED (2026-07-11, `poam-hardening`).** The DEBUG HOLE
+  (passwordless root shell) and its `debug_shell` variable are deleted from the
+  template entirely; no build can bake it (closes POA&M P-02 / R-02). Offline
+  diagnosis via `rootfs.erofs` mount + SMBIOS `enforcing=0` remains the supported
+  path (SMBIOS cmdline-extra works on Proxmox only after a full VM **stop/start**,
+  not `reset`).
 - **Admin SSH key MUST be ECDSA or RSA, NOT ed25519**, when STIG is on — the STIG
   crypto policy drops ed25519 from sshd's accepted pubkey algorithms. Set the
   `SSH_AUTHORIZED_KEY` CI secret to an ECDSA/RSA key (see #2).
@@ -158,7 +174,8 @@ was incomplete:**
   tailoring; production TLS offload tracked under #8. **(DONE 2026-07-12 — 2f is
   now gtls/6514 and the three waivers are dropped; see #8.)**
 - Diagnosis tooling notes: SMBIOS cmdline-extra works only after a Proxmox VM
-  **stop/start** (not `reset`); the debug-shell-on-tty2 never came up — the
+  **stop/start** (not `reset`); the debug-shell-on-tty2 never came up (and is now
+  removed from the template — see the build-posture section) — the
   decisive diagnosis was **offline `rootfs.erofs` mount** + `ssh -vvv` +
   `enforcing=0`.
 
@@ -194,8 +211,9 @@ pass / N/A.
     `TYPE=sysadm_t ROLE=sysadm_r NOPASSWD:ALL` and maps the admin to **`staff_u`**
     (`semanage login`) so the sudo role transition is authorized. ⚠ **TWO BENCH
     GATES:** (a) admin SSH login + sudo + privileged ops must work under `staff_u`
-    confinement (escape hatch: `enable_stig=false` → reverts to a justified
-    deviation); (b) **reproducibility** — `semanage` rebuilds the policy store;
+    confinement (if it locks out, waive the offending rule in the tailoring as a
+    justified deviation — `enable_stig=false` is no longer available, STIG is
+    enforced-true); (b) **reproducibility** — `semanage` rebuilds the policy store;
     confirm the verity hash is stable across two builds (normalize in 2d if it
     drifts). Needs `policycoreutils-python-utils` (installed in 2c-STIG if absent).
 
@@ -297,8 +315,13 @@ and cleanup.
   "Permissions 640 too open" and refused to start). RHEL's `sshd-keygen@.service`
   regenerates them into the overlay before sshd starts. **⚠ Caveat:** the
   ephemeral overlay means they regenerate **every boot** → the host key changes
-  per reboot (clients warn). Follow-up for a stable host identity: persist the
-  host keys or derive them from the TPM (ties to the hostnqn/identity model).
+  per reboot (clients warn). **RESOLVED (F-02/P-17, bench-verified 2026-07-11 on
+  comet-beacon-54):** rather than persist a key, each per-boot key is signed into
+  an OpenSSH host certificate by the fleet SSH CA via the enrol-broker host plane
+  at boot (`files/ssh-hostcert` → `fleet-ssh-hostcert`); admins trust one
+  `@cert-authority` line instead of TOFU. See
+  [ssh-host-certificate-design.md](ssh-host-certificate-design.md). Bench-surfaced
+  fixes on branch `poam-hardening` (`28d31e4`).
 
 ## [ ] 3. Roll the errata into design doc v3
 
@@ -416,6 +439,10 @@ Path to getting here (don't re-discover):
     stripped from `/etc/chrony.conf`. Result: the workstation syncs time only
     from the lab server — no external NTP egress. BENCH-VERIFY: on a booted host
     `chronyc sources` shows the lab server (the DHCP one), not a public pool.
+    **SUPERSEDED (2026-07-11, `secure-ntp`) by `secure_ntp=true`:** the DHCP
+    option-42 path is now the *unauthenticated fallback*; the default is
+    NTS/CA-authenticated time (the DHCP source is no longer mixed in). See the
+    build-posture note above + docs/secure-ntp-design.md.
 - **Image size:** Chromium+Mesa add hundreds of MB to the *uncompressed* erofs —
   feeds the "shrink the rootfs" concern (and #7); reconsider whether a lighter
   browser/render path is viable.