From c98d83f59675766d30fcc0a43b59993787250de9 Mon Sep 17 00:00:00 2001 From: shankar0123 Date: Thu, 30 Apr 2026 03:12:25 +0000 Subject: [PATCH] fix(README): drop hardcoded source-counts from EST row to satisfy S-1 guard MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CI's 'Forbidden hardcoded source-count prose regression guard (S-1)' fired on the new EST row in README.md:109. The trip was on the literal '6 MCP tools' phrase — that matches the regex pattern \b[0-9]+\s+MCP tools\b which the S-1 guard rejects per the CLAUDE.md rule 'Numeric claims about current state rot.' Same rule covers the '13 typed audit-action codes' literal earlier on the same line — the regex doesn't catch that one specifically (no 'audit-action codes' alternation in the guard pattern), but the spirit of the rule applies, so I removed it preemptively to avoid the next operator-reads-the-doc-then-edits-the-code-then-the-count-is-wrong drift cycle. Replacements: '13 typed audit-action codes (...)' → 'Typed audit-action codes per failure dimension (... — full set in internal/service/est_audit_actions.go)' 'CLI + 6 MCP tools' → 'CLI + matching MCP tool family (rebuild count via grep -cE '"est_' internal/mcp/tools_est.go)' The rebuild-command form follows the convention CLAUDE.md::Current-state commands established + the existing docs/features.md row 'MCP tools | rebuild via grep -cE 'gomcp\.AddTool\(' ...' Verified locally with the exact CI guard regex against README.md + docs/ — 'S-1 stale-counts guardrail: clean.' The 'All six RFC 7030 endpoints' phrasing earlier on the same line is NOT a current-state count — six is fixed by RFC 7030 (cacerts + simpleenroll + simplereenroll + csrattrs + serverkeygen + fullcmc), not derived from source. The S-1 regex requires \b[0-9]+ literal digits, so 'six' as a word doesn't match anyway. --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 5543d6c..8a15227 100644 --- a/README.md +++ b/README.md @@ -106,7 +106,7 @@ gantt | Protocol | Standard | Use Case | |----------|----------|----------| -| **EST (production-grade)** | RFC 7030 + RFC 9266 channel binding | Native EST server hardened for enterprise WiFi/802.1X, IoT bootstrap, and corporate device enrollment (post-2026-04-29 hardening master bundle). All six RFC 7030 endpoints — `cacerts` / `simpleenroll` / `simplereenroll` / `csrattrs` (profile-driven) / `serverkeygen` (CMS EnvelopedData wire format). Multi-profile dispatch (`/.well-known/est//`). Per-profile auth modes: mTLS sibling route at `/.well-known/est-mtls//`, HTTP Basic enrollment-password (constant-time compare + per-source-IP failed-auth limiter), RFC 9266 `tls-exporter` channel binding (TLS 1.3, opt-in per profile). Per-(CN, sourceIP) sliding-window rate limit. EST-source-scoped bulk revoke (`POST /api/v1/est/certificates/bulk-revoke`, M-008 admin-gated). Tabbed admin GUI at `/est` (Profiles / Recent Activity / Trust Bundle). `SIGHUP`-equivalent trust-bundle reload. libest reference-client interop tested in CI (`deploy/test/libest/Dockerfile` + `deploy/test/est_e2e_test.go`). 13 typed audit-action codes (`est_simple_enroll_success`/`_failed`, `est_auth_failed_basic`/`_mtls`/`_channel_binding`, `est_rate_limited`, `est_csr_policy_violation`, `est_bulk_revoke`, `est_trust_anchor_reloaded`, etc.). CLI + 6 MCP tools. See [`docs/est.md`](docs/est.md) for the operator guide — WiFi/802.1X + FreeRADIUS recipe, IoT bootstrap, troubleshooting matrix per audit-action code. | +| **EST (production-grade)** | RFC 7030 + RFC 9266 channel binding | Native EST server hardened for enterprise WiFi/802.1X, IoT bootstrap, and corporate device enrollment (post-2026-04-29 hardening master bundle). All six RFC 7030 endpoints — `cacerts` / `simpleenroll` / `simplereenroll` / `csrattrs` (profile-driven) / `serverkeygen` (CMS EnvelopedData wire format). Multi-profile dispatch (`/.well-known/est//`). Per-profile auth modes: mTLS sibling route at `/.well-known/est-mtls//`, HTTP Basic enrollment-password (constant-time compare + per-source-IP failed-auth limiter), RFC 9266 `tls-exporter` channel binding (TLS 1.3, opt-in per profile). Per-(CN, sourceIP) sliding-window rate limit. EST-source-scoped bulk revoke (`POST /api/v1/est/certificates/bulk-revoke`, M-008 admin-gated). Tabbed admin GUI at `/est` (Profiles / Recent Activity / Trust Bundle). `SIGHUP`-equivalent trust-bundle reload. libest reference-client interop tested in CI (`deploy/test/libest/Dockerfile` + `deploy/test/est_e2e_test.go`). Typed audit-action codes per failure dimension (`est_simple_enroll_success`/`_failed`, `est_auth_failed_basic`/`_mtls`/`_channel_binding`, `est_rate_limited`, `est_csr_policy_violation`, `est_bulk_revoke`, `est_trust_anchor_reloaded`, etc. — full set in `internal/service/est_audit_actions.go`). CLI + matching MCP tool family (rebuild count via `grep -cE '"est_' internal/mcp/tools_est.go`). See [`docs/est.md`](docs/est.md) for the operator guide — WiFi/802.1X + FreeRADIUS recipe, IoT bootstrap, troubleshooting matrix per audit-action code. | | SCEP (Simple Certificate Enrollment Protocol) | RFC 8894 | MDM platforms (Jamf, Intune), network devices, ChromeOS. Full RFC 8894 wire format: EnvelopedData decryption, signerInfo POPO verification, CertRep PKIMessage builder; PKCSReq + RenewalReq + GetCertInitial messageType dispatch; multi-profile dispatch (`/scep/`); per-profile RA cert + key. Lightweight raw-CSR clients keep working via the legacy MVP fall-through path. | | **Microsoft Intune SCEP fleet (drop-in NDES replacement)** | RFC 8894 + Intune Connector signed-challenge dispatcher | Per-profile Intune dispatcher validates the Connector's signed challenge against an operator-supplied trust anchor; binds device claim to CSR (set-equality on CN + SAN-DNS/RFC822/UPN); replay cache + per-device rate limit; `SIGHUP`-reloadable trust pool; admin GUI **SCEP Administration** page at `/scep` (Profiles tab with per-profile RA cert expiry + mTLS status, Intune Monitoring tab with per-status counters + reload, Recent Activity tab with full SCEP audit log filter). See [`docs/scep-intune.md`](docs/scep-intune.md) for the migration playbook + Microsoft support statement. | | ACME v2 | RFC 8555 | Public CA automated issuance (Let's Encrypt, ZeroSSL) |