 Audiobuzz
|
8e1418c19d
|
docs(ssh-host-cert): record F-02 bench-verified end-to-end (2026-07-11)
SSH host-cert flow proven on comet-beacon-54 (TPM-mTLS -> broker -> step-ca ->
cert install -> admin login by FQDN, no TOFU; per-boot auto-re-sign across
reboot). Design doc gains a Bench outcome section (defects+fixes table, retracted
empty-principals finding, post-boot TOFU window, deploy caveat); status flips to
BENCH-VERIFIED. TODO 'SSH host keys' caveat marked RESOLVED (F-02/P-17). The
bench-surfaced code/serving fixes live on branch poam-hardening (28d31e4).
|
2026-07-11 09:50:33 +00:00 |
|