Audiobuzz 3140d51d95 fleet-manager: document hardening status + remaining per-env items ...

DEPLOY.md gains a "Hardening status" section (done vs operator-to-close), and
TODO #14 records the deployment as CI-built + acme-cert + backup, with the open
items called out: network-segment the :9500/:9600 listeners to the mgmt net, run
server-pki.sh when the agent lands, choose :9500 vs a 443 proxy, and digest-pin
the images.

2026-07-05 00:36:01 +00:00

..

design-v2-errata.md

tpm-enrol: move NV cert index off OEM-occupied 0x01800001 → 0x01800100

2026-07-03 02:51:38 +00:00

diskless-fleet-design-v2.pdf

Initial commit

2026-06-12 01:46:29 +00:00

fleet-management-design.md

fleet-manager: checkpoint 7 — deployment (compose, PKI, deploy runbook, design-doc updates)

2026-07-04 08:44:31 +00:00

secure-boot-keys.md

Update SSP

2026-06-25 23:46:42 +00:00

ssp-annex-a-ism-residual-risk.md

tpm-enrol: move signing key off the EK slot 0x81010001 → 0x81000100

2026-07-02 12:19:59 +00:00

ssp.md

tpm-enrol: move NV cert index off OEM-occupied 0x01800001 → 0x01800100

2026-07-03 02:51:38 +00:00

stig-deviations.md

stig: ship SELinux allow module for chrony DHCP-NTP dispatcher (stop chronyd AVC)

2026-07-03 01:16:26 +00:00

TODO.md

fleet-manager: document hardening status + remaining per-env items

2026-07-05 00:36:01 +00:00

tpm-enrolment-design.md

fleet-manager: checkpoint 7 — deployment (compose, PKI, deploy runbook, design-doc updates)

2026-07-04 08:44:31 +00:00