T

Admin 950b6e5827 feat(security): trusted-services surface + auth mgmt client (M2 §3)

Maestro is the UI/CA, not the enforcement: the auth service owns its
authorized-keys trust store. This is Maestro's side of the flow.

- lib/authmgmt: mTLS management client (Maestro's own identity cert from
  the instance CA) for /internal/{attestation,authorizations,revoke,
  pending}; RevokeServiceBestEffort for uninstall.
- handlers/peers: GET /api/peers, /api/peers/attestation, POST
  approve/revoke.
- uninstall: revoke the service's authorization in the auth trust store
  alongside the CRL identity revocation.
- frontend: TrustedServices panel (pending first-contact authorizations +
  approved keys with authorize/ignore/revoke actions).
- spec.yaml: document the new endpoints and schemas.
- housekeeping: untrack pki test log artifacts, gofmt fixes in pki.

2026-08-15 23:27:21 +01:00

.gitea/workflows

fix: Tighten license autocommit bot to PRs, implement .licenseignore for ignoring specific files or directories

2026-08-04 23:34:46 +01:00

.vscode

real init

2026-07-29 01:36:09 +01:00

src

feat(security): trusted-services surface + auth mgmt client (M2 §3)

2026-08-15 23:27:21 +01:00

.dockerignore

real init