Audiobuzz 1e1265b5a0 docs/TODO: add #15 — scope root overlay to per-subtree tmpfs (un-shadowable /usr + STIG mount options) ...

Captures the design + quantified STIG payoff (~21 mount/partition rules
notapplicable/waived -> pass, per reports/stig-arf.xml), the writable-set +
noexec/nosuid/nodev flag matrix, the kiosk-/tmp-noexec prerequisite, the
fstab-vs-runtime OVAL note, and that it's bench-gated after TPM enrolment (#11).

2026-07-02 11:31:33 +00:00

..

design-v2-errata.md

Update SSP

2026-06-25 23:46:42 +00:00

diskless-fleet-design-v2.pdf

Initial commit

2026-06-12 01:46:29 +00:00

fleet-management-design.md

initial tpm broker

2026-06-28 10:33:14 +00:00

secure-boot-keys.md

Update SSP

2026-06-25 23:46:42 +00:00

ssp-annex-a-ism-residual-risk.md

Add SIEM

2026-06-27 08:52:17 +00:00

ssp.md

Add SIEM

2026-06-27 08:52:17 +00:00

stig-deviations.md

Add Host API and fix kiosk performance

2026-06-28 03:14:25 +00:00

TODO.md

docs/TODO: add #15 — scope root overlay to per-subtree tmpfs (un-shadowable /usr + STIG mount options)

2026-07-02 11:31:33 +00:00

tpm-enrolment-design.md

tpm-enrol: pivot host enrolment to a Go binary, built out-of-VM

2026-07-02 09:55:54 +00:00