12 Commits

Author	SHA1	Message	Date
shankar0123	3e91c7a1f0	chore(security): bump Go toolchain 1.25.9 -> 1.25.10 + golang.org/x/net 0.49 -> 0.53 ... CI run #484's Go Build & Test job failed govulncheck (M-024 hard gate). Six standard-library CVEs land in go1.25.9 + one golang.org/x/net CVE in v0.49.0; all are fixed in go1.25.10 + x/net v0.53.0 respectively. The advisories that fired were: GO-2026-4986 Quadratic string concat in net/mail.consumeComment — called via internal/api/handler/validation.go's ValidateCommonName -> mail.ParseAddress GO-2026-4977 Quadratic string concat in net/mail.consumePhrase — same call site GO-2026-4982 Bypass of meta-content URL escaping in html/template — called via internal/service/digest.go's RenderDigestHTML -> Template.Execute GO-2026-4980 Escaper bypass in html/template — same call site GO-2026-4971 Panic in net.Dial / LookupPort on Windows NUL bytes — many call sites (email notifier, SSH connector, ACME validators, validation.ValidateSafeURL, ...) GO-2026-4918 Infinite loop in net/http2 transport on bad SETTINGS_MAX_FRAME_SIZE — called via internal/connector/target/f5.go's F5Client.Authenticate -> http.Client.Do Bumps applied: * `go.mod`: `go 1.25.9` -> `go 1.25.10`; `golang.org/x/net v0.49.0` -> `v0.53.0` (kept indirect — the upgrade is force-pulled by the module-version directive; transitive deps will pick the higher). * `.github/workflows/{ci,codeql,release}.yml`: setup-go pin and the release.yml `GO_VERSION` env var bumped to 1.25.10. The security-deep-scan.yml workflow uses the major-minor `1.25` pin which auto-resolves to the latest 1.25.x and is unaffected. * `Dockerfile` + `Dockerfile.agent`: `golang:1.25-alpine@sha256:5caa...` re-pinned to `golang:1.25.10-alpine@sha256:8d22e29d960bc50cd0...` (digest looked up against `registry-1.docker.io/v2/library/golang/ manifests/1.25.10-alpine`; verified by the digest-validity ci-guard). The explicit `1.25.10-alpine` tag form replaces the moving `1.25-alpine` pin so the image-spec is reproducible end-to-end even without the digest reference. * `deploy/test/f5-mock-icontrol/Dockerfile`: `golang:1.25.9-bookworm @sha256:1a14...` re-pinned to `golang:1.25.10-bookworm@sha256: e3a54b77385b4f8a31c1...` (looked up the same way). * `deploy/test/f5-mock-icontrol/go.mod`: `go 1.25.9` -> `go 1.25.10`. * `internal/api/handler/version.go` + `api/openapi.yaml`: the `runtime.Version()`-shape comment + OpenAPI `example: go1.25.9` bumped to keep doc/example freshness. * `docs/contributor/ci-pipeline.md` + `docs/reference/connectors/ iis.md`: doc-only `Go 1.25.9` -> `Go 1.25.10` references. Verification done in-tree: * All `scripts/ci-guards/*.sh` pass locally including `digest-validity.sh` (the new digests resolve cleanly against Docker Hub). * `S-1-hardcoded-source-counts.sh` clean (the false-positive on "Bundle 1 migrations" was fixed in the prior commit). Operator step required post-push (sandbox has no Go toolchain): cd certctl && go mod tidy This regenerates go.sum's `golang.org/x/net v0.49.0` h1: lines into v0.53.0 ones. CI's `go mod tidy && git diff --exit-code go.mod go.sum` step will catch the drift if missed; in that case run the command, commit, and push the go.sum-only delta.	2026-05-09 21:35:46 -04:00
shankar0123	75097909e9		2026-05-05 18:18:29 +00:00
shankar0123	622cd29f20	docs: factuality sweep — fix 3 broken links + 12 count claims (audit findings 2026-05-05) ... Per the cowork/docs-audit-2026-05-05/ end-to-end factuality audit (20 confirmed findings across 76 docs, 7 parallel subagents + audit-of-the-audit). Hot + Warm tier fixes ship here; STALE findings (qa-test-suite.md test-count snapshot) need 'make qa-stats' which is operator-side. BROKEN links repaired (3): - docs/reference/api.md L195: [Quick Start](quickstart.md) → ../getting-started/quickstart.md (404 pre-fix) - docs/reference/api.md L196: [Connector Guide](connectors.md) → connectors/index.md (Phase 4 rename, was 404 pre-fix) - docs/reference/protocols/scep-intune.md L377: [legacy-est-scep.md](legacy-est-scep.md) → scep-server.md (file was deleted in Phase 7 commit e9b1510) INCORRECT count claims repaired (12): - api.md L5 + L18-19 + L155: '78 API operations' / '# 78' / 'all 78 documented operations' → re-derive via grep -cE '^\s+operationId:' (actual at HEAD: 144) - architecture.md L66 (Mermaid label) + L502 + L1047 + L1253: '8 always-on + 4 optional loops' / '12-loop topology' → 9 always-on + 5 opt-in loops (14 total). Always-on/opt-in breakdown derived from cmd/server/main.go startup wiring: always-on are agentHealthCheck, crlGeneration, jobProcessor, jobRetry, jobTimeout, notificationProcess, notificationRetry, renewalCheck, shortLivedExpiryCheck (9); opt-in are networkScan, digest, healthCheck, cloudDiscovery, acmeGC (5). Re-derive count via grep -cE '^func \(s \*Scheduler\) [a-zA-Z]+Loop' internal/scheduler/scheduler.go. - configuration.md L31: '12 loops, 8 always-on + 4 opt-in' → '14 loops, 9 always-on + 5 opt-in'. Self-introduced regression from commit 3275f9f (2026-05-05). - mcp.md L11 + L65: 'all 78 API endpoints' / '78 available tools' → re-derive via grep -cE 'mcp\.AddTool\(' (actual at HEAD: 87 MCP tools, 144 API operations). - connectors/index.md L111: '9 built-in' issuer connectors → '12 built-in', extending the inline enumeration to include Entrust, GlobalSign, EJBCA (which had been added since the L111 prose was written). Local-CA framing extended to mention tree mode + ADCS sub-CA mode-doc. - connectors/index.md L112: '14 built-in' target connectors → '15 built-in', adding AWS ACM target + Azure Key Vault target (which had been added since the L112 prose was written). - why-certctl.md L37 + the inline list: 'Nine issuer connectors ship today' → 'Twelve issuer connectors', adding AWS ACM PCA, Entrust, GlobalSign, EJBCA to the list and removing the misleading 'EST enrollment' bullet (EST is a protocol surface, not an issuer; clarified in trailing note). - why-certctl.md L66: '13 deployment targets' → '15', adding Kubernetes Secrets, AWS ACM, and Azure KV to the inline list. - why-certctl.md L92: 'supports 9 issuer types' → '12 issuer types'. - quickstart.md L135: '35 demo certificates across 5 issuers' → re-derive cert count via 'grep -oE "mc-[a-z0-9_-]+" migrations/seed_demo.sql | sort -u | wc -l' (actual: 32, matches README L86; quickstart was off-by-3). - quickstart.md L452 (Demo Data Reference table): Certificates '35' → '32' (matches the cert count from seed_demo.sql). Verification: - grep confirms no remaining stale refs across the touched files (8 files, 31 insertions / 28 deletions). - All 24 ci-guards/*.sh pass locally. - The audit's STALE findings (S-1, S-2 qa-test-suite.md Bundle-P snapshot) are operator-side: run 'make qa-stats' to refresh the Test Suite Health table. Companion: cowork/docs-audit-2026-05-05/RESULTS.md captures the full audit with subagent false positives and missed findings called out.	2026-05-05 06:15:35 +00:00
shankar0123	d809874fa1	docs: retire compliance subtree + sweep framework name-drops from prose ... Per operator decision the framework-mapping docs are gone. They were aspirational (no audit, no certification, no validated mapping); keeping them around was misleading. Files deleted (1,883 lines): - docs/compliance/index.md - docs/compliance/soc2.md - docs/compliance/pci-dss.md - docs/compliance/nist-sp-800-57.md Hyperlinks removed: - README.md: 'Auditor / compliance' row in the doc table; the '(compliance mapping included)' parenthetical in the positioning paragraph - docs/README.md: the '## Compliance' section table; the 'Auditor / compliance team' reading-order-by-role row Prose name-drops swept across 24 files: - README.md: 'FedRAMP boundary CAs / financial-services policy CAs' → '4-level boundary CAs / 3-level policy CAs'; 'Compliance-grade for PCI-DSS Level 1, FedRAMP Moderate / High, SOC 2 Type II, HIPAA' → cut entirely - getting-started/{quickstart,concepts,examples,why-certctl, advanced-demo}.md: 'compliance' → 'audit' / 'policy'; 'PCI-DSS / SOC 2 / NIST SP 800-57' framework lists cut; ''pci': 'true'' tag example → ''environment': 'production'' - migration/cert-manager-coexistence.md: 'compliance rules' → 'policy rules' - operator/approval-workflow.md: 'Compliance customers (PCI-DSS Level 1, FedRAMP Moderate / High, SOC 2 Type II, HIPAA)' → 'Operators'; entire 'Compliance control mapping' table (PCI-DSS §6.4.5 / NIST SP 800-53 SA-15 / SOC 2 Type II CC6.1 / HIPAA §164.308(a)(4)) deleted; 'compliance contract' → 'two-person-integrity contract'; 'compliance auditors' → 'reviewers' - operator/legacy-clients-tls-1.2.md: 'PCI-DSS v4.0 Req 4 §2.2.5' audit-reference → CWE-326 (kept); 'PCI-DSS Req 4 §2.2.5 attestation' section retitled to 'TLS posture summary' and rewritten without framework framing; 'PCI-DSS, NIST, and major browsers will eventually deprecate TLS 1.2' → 'Major browsers and OS vendors will eventually deprecate TLS 1.2' - operator/database-tls.md: PCI-DSS Req 4 §2.2.5 audit-ref → CWE-319 only; 'PCI-DSS scope' → 'sensitive data'; PCI-DSS Req 4 v4.0 prose footing → cut - operator/runbooks/disaster-recovery.md: 'SOC 2 / PCI procurement-team deliverable' → 'on-call deliverable'; 'compliance auditors' → 'reviewers' - reference/connectors/{acme,aws-acm,azure-kv,globalsign, local-ca,openssl,ssh,index}.md: 'compliance reporting (PCI-DSS §3.6, HIPAA §164.312)' → 'audit reporting'; 'Compliance environments (PCI-DSS Level 1, FedRAMP High, HIPAA)' → 'Regulated environments'; 'compliance audits' → 'audit'; 'FedRAMP boundary CA' pattern names → '4-level boundary CA' (technically descriptive) - reference/protocols/est.md: 'compliance-hook seam' → 'device-state hook seam'; 'compliance gating' → 'device-state gating'; 'est_compliance_failed' → 'est_device_state_failed' - reference/protocols/scep-intune.md: 'Optional compliance check' → 'Optional device-state check'; failure-counter 'compliance_failed' → 'device_state_failed'; 'Conditional Access compliance gating' → 'Conditional Access device-state gating' - reference/intermediate-ca-hierarchy.md: 'FedRAMP boundary-CA deployments where the regulator requires...' → 'Boundary-CA deployments where you want separation of policy and issuing authorities'; pattern A retitled '4-level FedRAMP boundary CA' → '4-level boundary CA' - reference/architecture.md: broken Related-docs link to compliance.md removed; the rest of that block had stale pre-Phase-2 paths (quickstart.md, demo-advanced.md, connectors.md, openapi.md, testing-guide.md, test-env.md) — retargeted to current locations - reference/deployment-model.md: 'SOC 2 evidence-report generator' → 'Audit-evidence report generator' - reference/vendor-matrix.md: 'SOC 2 / PCI auditors paste this into evidence packs' → 'reviewers paste this into vendor-evaluation packs' - contributor/qa-test-suite.md: 'compliance exist' coverage description cut; 'Compliance (PCI / SOC2 / HIPAA-relevant)' risk-class label → 'Audit-relevant' What was kept: - CWE references (legitimate technical pointers) - Microsoft API/feature names that happen to use 'compliance' literally ('Microsoft Graph compliance API', 'device-compliance validators' — these are MS product names, not framework name-drops) - 'NIST PQC' on the landing page (Post-Quantum Cryptography is the actual NIST standard family, not a compliance framework) Verified: zero hyperlinks into docs/compliance/ remain. All 24 ci-guards/*.sh pass locally. qa-doc-seed-count.sh clean. Net diff: 26 files / -1,883 deletions in compliance/ + -32 net across the prose sweep. Companion edits in cowork/ (CLAUDE.md doc-tree summary + WORKSPACE-CHANGELOG.md retirement note) land separately.	2026-05-05 05:26:44 +00:00
shankar0123	3275f9f1e0	ci: post-Phase-2-docs-overhaul cleanup of stale guards + missing config doc ... CI run on the ecb8896 push surfaced two real failures rooted in the 2026-05-04 docs overhaul: 1. G-3 env-docs-drift caught two phantom CERTCTL_* env vars I'd introduced in the Phase 4 follow-on connector pages (CERTCTL_CA_CERT_PATH_NEW in adcs.md was a placeholder I made up; CERTCTL_EJBCA_POLL_MAX_WAIT_SECONDS in ejbca.md does not exist in source). Both removed. 2. QA-doc Part-count drift guard tried to grep docs/qa-test-guide.md and docs/testing-guide.md, both of which were renamed/deleted in Phase 2/Phase 5. The Part-count drift class died with testing-guide.md (Phase 5 prune dispersed its content); the seed-count drift class is still live but pointed at the wrong path. Fixes: - Removed the QA-doc Part-count drift guard from ci.yml (premise dead) plus its standalone scripts/qa-doc-part-count.sh peer. - Retargeted the QA-doc seed-count drift guard from docs/qa-test-guide.md → docs/contributor/qa-test-suite.md (the Phase 2 target). Updated both ci.yml inline copy and scripts/qa-doc-seed-count.sh. - Updated Makefile qa-stats: target to drop the testing-guide.md Parts metric (file is gone). - Updated Makefile verify-docs: target to drop the part-count step. G-3 was also failing in the second direction (env vars defined in config.go but never documented anywhere). 16 vars surfaced — features.md (deleted Phase 6) and testing-guide.md (deleted Phase 5) had been their canonical home. Created docs/reference/configuration.md as the new home: a compact operator-facing env-var reference covering scheduler intervals, job lifecycle, rate limiting, audit, deploy verify, database, agent-side, and SCEP profile binding. Added to docs/README.md Reference table. Doc-side updates to qa-test-suite.md to reframe its references to the deleted testing-guide.md (it's now self-contained: the Part-by-Part Coverage Map IS the canonical Part inventory). Cosmetic comment-only updates in ci.yml + scripts/ci-guards/*.sh + scripts/dev-setup.sh to point at the new audience-organized doc paths (docs/operator/security.md, docs/operator/tls.md, docs/reference/architecture.md, etc.) instead of the pre-Phase-2 flat layout. Verified: all 24 ci-guards/*.sh pass locally; qa-doc-seed-count.sh clean. Net diff: 178 additions / 112 deletions across 13 files. One file deleted (qa-doc-part-count.sh) and one file added (docs/reference/configuration.md).	2026-05-05 04:56:26 +00:00
shankar0123	ecb8896b1c	docs: cleanup pre-existing broken links in connector pages ... Phase 4 structural (commit 633e440) moved 6 connector files into the new docs/reference/connectors/ subdirectory but didn't update all inter-doc references for the new path layout. Phase 11 caught the high-traffic ones; this sweep gets the rest, found by the Phase 4 follow-on verification pass. Mappings applied (relative to docs/reference/connectors/): deployment-atomicity.md → ../deployment-model.md deployment-vendor-matrix.md → ../vendor-matrix.md architecture.md → ../architecture.md est.md → ../protocols/est.md scep-intune.md → ../protocols/scep-intune.md async-polling.md → ../protocols/async-ca-polling.md quickstart.md → ../../getting-started/quickstart.md demo-advanced.md → ../../getting-started/advanced-demo.md legacy-est-scep.md → ../protocols/scep-server.md connectors.md → index.md Plus prose backtick references (`docs/architecture.md` etc.) updated to the new subdirectory paths. Files touched: apache, f5, iis, k8s, nginx, index. 33 line changes. Full link-check across docs/reference/connectors/*.md is now clean (0 broken inter-doc references).	2026-05-05 04:10:09 +00:00
shankar0123	969853ee53	docs: Phase 4 follow-on batch 4 — 5 final target per-pages ... Extracts the remaining target connectors: - ssh.md (194 lines) — agentless SSH/SFTP deploy with full host-key-acceptance threat model (what's accepted, what's not, mitigations including known_hosts enforcement and SSH cert auth); V3-Pro forward path - wincertstore.md (118 lines) — non-IIS Windows services via local PowerShell or WinRM proxy mode; store selection (My / Root / WebHosting); private-key permissions guidance - jks.md (189 lines) — JKS / PKCS#12 via keytool with full atomic snapshot+rollback contract (Bundle 8 'snapshot → delete → import → reload'), keytool argv password exposure threat model + mitigations - aws-acm.md (208 lines) — ACM target with full IAM policy, IRSA / instance-profile / SSO auth recipes, atomic-rollback contract, ALB attachment Terraform recipe, procurement-checklist crib - azure-kv.md (195 lines) — Key Vault target with managed-identity / workload-identity / service-principal auth recipes, version- semantics rollback caveat (no in-place restore without soft-delete), App Gateway / Front Door attachment recipe Index forward-list expanded to enumerate all 15 target connectors (5 from Phase 4 structural + 5 from batch 3 + 5 from this batch) in alphabetical order. This is part 4 of 4 for the Phase 4 follow-on (per-connector page extraction) tracked in cowork/docs-overhaul-phase-2-restructure-2026-05-04/log.md. Net add: 5 files, 904 lines. No content removed from index.md. End-state of Phase 4 follow-on: - 13 issuer per-pages (5 batch 1 + 8 batch 2) - 15 target per-pages (5 Phase 4 structural + 5 batch 3 + 5 batch 4) - index.md keeps its inline reference content; per-pages add operator depth on top, matching the pattern set by apache/f5/iis/k8s/nginx in Phase 4 structural	2026-05-05 04:07:21 +00:00
shankar0123	082b8cf660	docs: Phase 4 follow-on batch 3 — 5 file-based target per-pages ... Extracts the file-based deploy target connectors: - haproxy.md (107 lines) — combined-PEM (cert+chain+key) deploy with haproxy -c validate; multi-frontend + crt-list directory guidance - traefik.md (105 lines) — file-provider zero-reload deploy; file watcher latency notes; mixing with built-in ACME guidance - caddy.md (100 lines) — admin API mode (recommended) vs file mode; admin-API exposure threat model - envoy.md (112 lines) — file SDS mode (recommended) vs static bootstrap; service-mesh interactions - postfix.md (175 lines) — dual-mode (Postfix MTA / Dovecot IMAPS) connector with daemon-specific quirks (STARTTLS chain expectations, no shared session cache); Bundle 11 test pins Index forward-list expanded to enumerate all 10 target connectors (5 from Phase 4 structural + 5 from this batch) in alphabetical order. This is part 3 of 4 for the Phase 4 follow-on (per-connector page extraction) tracked in cowork/docs-overhaul-phase-2-restructure-2026-05-04/log.md. Net add: 5 files, 599 lines. No content removed from index.md.	2026-05-05 04:02:25 +00:00
shankar0123	de06141ce5	docs: Phase 4 follow-on batch 2 — 8 remaining issuer per-pages ... Extracts the rest of the issuer per-connector deep-dive pages: - local-ca.md (170 lines) — Local CA self-signed / sub-CA / tree mode, CRL+OCSP endpoints, EKU support, MaxTTL enforcement, L-014 file-on- disk threat model carve-out - acme.md (235 lines) — RFC 8555 v2 client (HTTP-01 / DNS-01 / DNS-PERSIST-01), ARI per RFC 9773, EAB + ZeroSSL auto-EAB, Let's Encrypt profile selection, revoke-by-serial Top-10 fix #7 - step-ca.md (99 lines) — Smallstep JWK-provisioner synchronous issuance with MaxTTL enforcement - openssl.md (157 lines) — script-based shell-out with full threat model (what's accepted, what's not, mitigations, V3-Pro forward path) - sectigo.md (98 lines) — Sectigo SCM REST with bounded async polling - google-cas.md (89 lines) — GCP managed private CA with OAuth2 service-account auth + IAM-role guidance - entrust.md (96 lines) — Entrust CA Gateway mTLS-authenticated with approval-pending support and mTLS keypair caching - globalsign.md (122 lines) — Atlas HVCA dual auth (mTLS + API key/secret), region-aware base URLs, mTLS keypair caching Index forward-list expanded to enumerate all 13 issuer connectors (including the 5 pages from batch 1) in alphabetical order. This is part 2 of 4 for the Phase 4 follow-on (per-connector page extraction) tracked in cowork/docs-overhaul-phase-2-restructure-2026-05-04/log.md. Net add: 8 files, 1,066 lines. No content removed from index.md.	2026-05-05 03:59:35 +00:00
shankar0123	fd94205cfa	docs: Phase 4 follow-on batch 1 — 5 issuer per-pages ... Extract the first 5 issuer per-connector deep-dive pages: - vault.md (128 lines) — Vault PKI synchronous issuance, token TTL + auto-renewal loop, MaxTTL enforcement, rotation playbook - digicert.md (106 lines) — CertCentral DV/OV/EV with bounded async polling for vetting workflows - aws-acm-pca.md (165 lines) — managed private CA on AWS with full IAM policy, IRSA wiring, troubleshooting matrix - ejbca.md (116 lines) — open-source / Keyfactor EJBCA with mTLS or OAuth2 auth, mTLS keypair caching, approval-pending guidance - adcs.md (111 lines) — Active Directory Certificate Services as enterprise root via Local CA sub-CA mode, sub-CA rotation playbook Index updated with forward-list entries and the index-purpose blurb revised so the index now positions itself as 'navigate from here; deeper material lives in siblings' rather than 'docs to be extracted later'. Each per-page follows the WHAT/HOW/WHY pattern: what the connector is, how authentication and issuance work, and when to choose this vs an alternative. Cross-links to the connector index, async-ca-polling primitive, and adjacent operator runbooks. This is part 1 of 4 for the Phase 4 follow-on (per-connector page extraction) tracked in cowork/docs-overhaul-phase-2-restructure-2026-05-04/log.md. Net add: 5 files, 626 lines. No content removed from index.md (the index keeps its inline reference; per-pages add operator depth on top, matching the pattern set by apache/f5/iis/k8s/nginx in Phase 4 structural).	2026-05-05 03:53:52 +00:00
shankar0123	a364cd6990	docs: Phase 11 follow-on — fix anchor-bearing + remaining inter-doc links ... Per Phase 1 audit at cowork/docs-overhaul-phase-1-audit-2026-05-04/. Sweeps the anchor-bearing inter-doc links that the previous Phase 11 sed pass missed (anchors after .md# weren't matched), plus a few remaining cross-refs in docs/reference/. Per source file: docs/migration/acme-from-caddy.md (1 anchor link): (./acme-server.md#certificate-readyfalse-with-rejectedidentifier) → (../reference/protocols/acme-server.md#certificate-readyfalse-...) docs/migration/acme-from-cert-manager.md (3 anchor links): Same shape; all (./acme-server.md#...) → (../reference/protocols/acme-server.md#...) docs/reference/connectors/index.md (5 walkthrough + reference links): (./acme-server.md) → (../protocols/acme-server.md) (./acme-server-threat-model.md) → (../protocols/acme-server-threat-model.md) (./acme-cert-manager-walkthrough.md) → (../../migration/acme-from-cert-manager.md) (./acme-caddy-walkthrough.md) → (../../migration/acme-from-caddy.md) (./acme-traefik-walkthrough.md) → (../../migration/acme-from-traefik.md) docs/reference/protocols/acme-server.md (3 walkthrough links): (./acme-cert-manager-walkthrough.md) → (../../migration/acme-from-cert-manager.md) (./acme-caddy-walkthrough.md) → (../../migration/acme-from-caddy.md) (./acme-traefik-walkthrough.md) → (../../migration/acme-from-traefik.md) docs/reference/protocols/acme-server-threat-model.md (1 cross-dir): (./tls.md) → (../../operator/tls.md) After this commit, every grep for old-style `./<old-doc-name>.md` links returns clean across docs/migration/, docs/reference/, and docs/operator/.	2026-05-05 03:31:47 +00:00
shankar0123	633e440787	docs: Phase 4 (structural) — move connectors.md + 5 deep dives into reference/connectors/ ... Per Phase 1 audit at cowork/docs-overhaul-phase-1-audit-2026-05-04/. Phase 4 in the audit recommended a full split of connectors.md (2055 lines) into an index + 27 per-connector pages (12 issuer + 15 target). This commit lands the structural half of that work; full per-target page extraction is deferred to follow-up commits. Renames (all blame-preserving): docs/connectors.md → docs/reference/connectors/index.md docs/connector-apache.md → docs/reference/connectors/apache.md docs/connector-f5.md → docs/reference/connectors/f5.md docs/connector-iis.md → docs/reference/connectors/iis.md docs/connector-k8s.md → docs/reference/connectors/k8s.md docs/connector-nginx.md → docs/reference/connectors/nginx.md Edits: - docs/reference/connectors/index.md gets a top-of-doc note explaining the per-connector deep-dive sibling pattern + a forward list of the 5 per-target pages. - The 5 per-connector deep-dive pages each get a `Last reviewed: 2026-05-05` header + a back-link to the index. Deferred to future commits (Phase 4b/c follow-on): - Extracting the 12 issuer sections from index.md into per-issuer pages at reference/connectors/{acme,awsacmpca,digicert,ejbca, entrust,globalsign,googlecas,local,openssl,sectigo,stepca,vault}.md - Extracting the 10 remaining target sections from index.md into per-target pages at reference/connectors/{caddy,traefik,envoy, haproxy,postfix-dovecot,ssh,javakeystore,wincertstore,awsacm, azurekv}.md The pragmatic split makes this Phase 4 work incrementally landable — each per-connector extraction is a small follow-up commit that doesn't change the docs/ tree shape further. Cross-references from README.md and other docs to docs/connectors.md still need fixing in Phase 11.	2026-05-05 03:14:39 +00:00