- go.mod: dcntrlized-auth v0.1.1 -> v0.1.2 (tlsutil.IsDev/AuthBaseURL and the
identity-mount client fallback).
- docker-compose.debug.yaml: DEV_MODE replaced by DCNTRLIZED_DEV=true (the
single dev selector); mount the devboot-issued identity at the shared-module
default /dcntrlized/pki so the authproxy edge is mTLS. INSECURE_INTERNAL=1
stays: the RN-facing listener must stay plaintext.
Serve the listener over TLS with ClientAuth=RequireAndVerifyClientCert
trusting the instance CA (shared tlsutil.ServerConfig): only Maestro can
drive actions (T4), and the peer edge is encrypted. INSECURE_INTERNAL=1
(dev debug compose) keeps the listener plaintext for the RN client's
direct mode and hot reload.
Admin