4 Commits

Author	SHA1	Message	Date
Leo Galambos	0312cf699f	feat(pki): reconcile recovered signing operations ... Add bounded durable reconciliation with retry metadata, fencing-safe status and cancellation handling, and server-managed background recovery. Include versioned persistence migration, bounded keyset paging, lifecycle-safe worker shutdown, redacted diagnostics, and restart/failure coverage. Closes #10	2026-08-12 01:48:11 +02:00
Leo Galambos	67989b232f	fix(pki): unify signing workflow cleanup lifecycle ... Consolidate synchronous signing onto PkiBusContentSigner. Ensure deterministic staging cleanup, operation retirement, and restart recovery. Add lifecycle regression tests and document retained terminal evidence.	2026-08-11 23:24:45 +02:00
Leo Galambos	7328f075dd	feat(pki-server): support trusted reverse-proxy authentication ... Support explicit direct-mTLS and trusted-reverse-proxy authentication modes with mutually authenticated backend transport. Keep proxy and end-client principals separate, validate forwarded certificates independently, and enforce narrowly scoped forwarding authority for RFC 9440 and NGINX escaped-PEM profiles.	2026-08-04 23:07:01 +02:00
Leo Galambos	e997996316	docs(pki): define server architecture and authorization model	2026-08-04 18:25:00 +02:00