Operator Controls

Egress / Isolation Posture

WARNING: default route not via tailscale0 — default via 172.19.0.1 dev eth0

The sim container must egress via wifi→internet/overlay only (G2 live proof). See README for pf/route enforcement details. The edge is reachable ONLY via Tailscale overlay — never the wire.

Admission Gate

open All hardware_ids are admitted (ADMISSION_STRICT=false).

Beacon mTLS

optional Dual-mode: validates cert when present, accepts cert-less.

Set REQUIRE_BEACON_MTLS=true after edge #19 §9 R6 ships.

Current Fleet Secret Kid

fleet-2026-06

Rotate by updating FLEET_KID + FLEET_SECRET_S (and optionally adding the old kid to FLEET_EXTRA_KIDS for in-flight enrollments) and restarting the sim.

#20 Forward Seams (stubs — not yet exercised)

Push config bundle → PUT /v1/config (PLANNED #20)
Push operator roster → PUT /v1/operators (PLANNED #20)
Send command → POST /v1/command (PLANNED #20)
OTA announce → POST /v1/ota (PLANNED #20)
Sysadmin diagnostics pull → GET /v1/diagnostics/bundle (PLANNED D13)