feat: wire ACME EAB into account registration + ZeroSSL auto-fetch

EAB credentials (KID + HMAC) were defined in the ACME connector config but never wired into the acme.Account registration call. This fixes the dead code and adds automatic EAB credential fetching for ZeroSSL — when the directory URL is detected as ZeroSSL and no EAB credentials are provided, certctl calls ZeroSSL's public API to get them automatically. Changes: - Wire EABKid/EABHmac into acme.Account.ExternalAccountBinding - Add isZeroSSL() detection and fetchZeroSSLEAB() auto-fetch - Add CERTCTL_ACME_EAB_KID/CERTCTL_ACME_EAB_HMAC env vars to main.go - Add 13 ACME connector tests (config validation, EAB decode, ZeroSSL auto-EAB with mock servers, URL detection) - Update docs: README, architecture, connectors, demo-advanced, testing-guide with EAB/auto-EAB documentation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
docs: add table of contents to all major documentation files
2026-06-08 08:28:54 +00:00 · 2026-03-27 15:34:48 -04:00 · 2026-03-26 23:38:28 -04:00 · 2026-03-26 23:29:33 -04:00 · 2026-03-26 23:27:42 -04:00 · 2026-03-26 14:29:56 -04:00
58 changed files with 1402 additions and 526 deletions
@@ -7,8 +7,6 @@

 # certctl — Self-Hosted Certificate Lifecycle Platform

-95+ API endpoints. 21 database tables. 930+ tests. Full GUI. Ships with Docker Compose.
-
 ```mermaid
 timeline
    title TLS Certificate Maximum Lifespan (CA/Browser Forum Ballot SC-081v3)
@@ -26,7 +24,7 @@ certctl is a self-hosted platform that automates the entire certificate lifecycl

 [![License](https://img.shields.io/badge/license-BSL%201.1-blue.svg)](LICENSE)
 [![Go Report Card](https://goreportcard.com/badge/github.com/shankar0123/certctl)](https://goreportcard.com/report/github.com/shankar0123/certctl)
-![Version: v2.0.2](https://img.shields.io/badge/version-v2.0.2-brightgreen)
+![Version: v2.0.3](https://img.shields.io/badge/version-v2.0.3-brightgreen)

 ## Documentation

@@ -38,7 +36,7 @@ certctl is a self-hosted platform that automates the entire certificate lifecycl
 | [Architecture](docs/architecture.md) | System design, data flow diagrams, security model |
 | [Connectors](docs/connectors.md) | Build custom issuer, target, and notifier connectors |
 | [Compliance Mapping](docs/compliance.md) | SOC 2 Type II, PCI-DSS 4.0, NIST SP 800-57 alignment guides |
-| [Manual Testing Guide](docs/testing-guide.md) | 284 tests across 25 areas — full V2 QA runbook with exact commands and pass/fail criteria |
+| [Manual Testing Guide](docs/testing-guide.md) | Extensively tested — full V2 QA runbook with exact commands and pass/fail criteria |

 ## Contents

@@ -72,7 +70,7 @@ certctl gives you a single pane of glass for every TLS certificate in your organ
 **Core capabilities:**

 - **Full lifecycle automation** — issuance, renewal, deployment, and revocation with zero human intervention. Configurable renewal policies trigger jobs automatically based on expiration thresholds.
- **CA-agnostic issuer connectors** — Local CA (self-signed + sub-CA for enterprise root chains), ACME v2 with HTTP-01, DNS-01, and DNS-PERSIST-01 challenges (Let's Encrypt, Sectigo, any ACME-compatible CA), Smallstep step-ca (native /sign API), and OpenSSL/Custom CA (delegate to any shell script). Pluggable interface — add your own CA in one file.
+- **CA-agnostic issuer connectors** — Local CA (self-signed + sub-CA for enterprise root chains), ACME v2 with HTTP-01, DNS-01, and DNS-PERSIST-01 challenges (Let's Encrypt, ZeroSSL, Sectigo, Google Trust Services, any ACME-compatible CA), External Account Binding (EAB) for CAs that require it (auto-fetched for ZeroSSL), Smallstep step-ca (native /sign API), and OpenSSL/Custom CA (delegate to any shell script). Pluggable interface — add your own CA in one file.
 - **Agent-side key generation** — agents generate ECDSA P-256 keys locally, store them with 0600 permissions, and submit only the CSR. Private keys never touch the control plane. This is the default mode, not an opt-in feature.
 - **Certificate discovery** — agents scan filesystems for existing PEM/DER certificates and report findings for triage. The network scanner probes TLS endpoints across CIDR ranges to find certificates you didn't know existed.
 - **Revocation infrastructure** — RFC 5280 revocation with all standard reason codes, DER-encoded X.509 CRL per issuer, embedded OCSP responder, and short-lived certificate exemption (certs under 1 hour skip CRL/OCSP).
@@ -89,29 +87,29 @@ certctl gives you a single pane of glass for every TLS certificate in your organ

 <table>
 <tr>
-<td><a href="docs/screenshots/v2/dashboard.png"><img src="docs/screenshots/v2/dashboard.png" width="270" alt="Dashboard"></a><br><b>Dashboard</b><br><sub>Stats, expiration heatmap, renewal trends</sub></td>
-<td><a href="docs/screenshots/v2/certificates.png"><img src="docs/screenshots/v2/certificates.png" width="270" alt="Certificates"></a><br><b>Certificates</b><br><sub>Inventory with status, owner, team filters</sub></td>
-<td><a href="docs/screenshots/v2/agents.png"><img src="docs/screenshots/v2/agents.png" width="270" alt="Agents"></a><br><b>Agents</b><br><sub>Fleet health, OS/arch, IP, version</sub></td>
+<td><a href="docs/screenshots/v2-dashboard.png"><img src="docs/screenshots/v2-dashboard.png" width="270" alt="Dashboard"></a><br><b>Dashboard</b><br><sub>Stats, expiration heatmap, renewal trends</sub></td>
+<td><a href="docs/screenshots/v2-certificates.png"><img src="docs/screenshots/v2-certificates.png" width="270" alt="Certificates"></a><br><b>Certificates</b><br><sub>Inventory with status, owner, team filters</sub></td>
+<td><a href="docs/screenshots/v2-agents.png"><img src="docs/screenshots/v2-agents.png" width="270" alt="Agents"></a><br><b>Agents</b><br><sub>Fleet health, OS/arch, IP, version</sub></td>
 </tr>
 <tr>
-<td><a href="docs/screenshots/v2/fleet-overview.png"><img src="docs/screenshots/v2/fleet-overview.png" width="270" alt="Fleet Overview"></a><br><b>Fleet Overview</b><br><sub>OS distribution, status breakdown</sub></td>
-<td><a href="docs/screenshots/v2/jobs.png"><img src="docs/screenshots/v2/jobs.png" width="270" alt="Jobs"></a><br><b>Jobs</b><br><sub>Issuance, renewal, deployment queue</sub></td>
-<td><a href="docs/screenshots/v2/notifications.png"><img src="docs/screenshots/v2/notifications.png" width="270" alt="Notifications"></a><br><b>Notifications</b><br><sub>Expiration warnings, renewal results</sub></td>
+<td><a href="docs/screenshots/v2-fleet.png"><img src="docs/screenshots/v2-fleet.png" width="270" alt="Fleet Overview"></a><br><b>Fleet Overview</b><br><sub>OS distribution, status breakdown</sub></td>
+<td><a href="docs/screenshots/v2-jobs.png"><img src="docs/screenshots/v2-jobs.png" width="270" alt="Jobs"></a><br><b>Jobs</b><br><sub>Issuance, renewal, deployment queue</sub></td>
+<td><a href="docs/screenshots/v2-notifications.png"><img src="docs/screenshots/v2-notifications.png" width="270" alt="Notifications"></a><br><b>Notifications</b><br><sub>Expiration warnings, renewal results</sub></td>
 </tr>
 <tr>
-<td><a href="docs/screenshots/v2/policies.png"><img src="docs/screenshots/v2/policies.png" width="270" alt="Policies"></a><br><b>Policies</b><br><sub>Ownership, lifetime, renewal rules</sub></td>
-<td><a href="docs/screenshots/v2/profiles.png"><img src="docs/screenshots/v2/profiles.png" width="270" alt="Profiles"></a><br><b>Profiles</b><br><sub>Key types, max TTL, crypto constraints</sub></td>
-<td><a href="docs/screenshots/v2/issuers.png"><img src="docs/screenshots/v2/issuers.png" width="270" alt="Issuers"></a><br><b>Issuers</b><br><sub>Local CA, ACME, step-ca connectors</sub></td>
+<td><a href="docs/screenshots/v2-policies.png"><img src="docs/screenshots/v2-policies.png" width="270" alt="Policies"></a><br><b>Policies</b><br><sub>Ownership, lifetime, renewal rules</sub></td>
+<td><a href="docs/screenshots/v2-profiles.png"><img src="docs/screenshots/v2-profiles.png" width="270" alt="Profiles"></a><br><b>Profiles</b><br><sub>Key types, max TTL, crypto constraints</sub></td>
+<td><a href="docs/screenshots/v2-issuers.png"><img src="docs/screenshots/v2-issuers.png" width="270" alt="Issuers"></a><br><b>Issuers</b><br><sub>Local CA, ACME, step-ca connectors</sub></td>
 </tr>
 <tr>
-<td><a href="docs/screenshots/v2/targets.png"><img src="docs/screenshots/v2/targets.png" width="270" alt="Targets"></a><br><b>Targets</b><br><sub>NGINX, Apache, HAProxy deployment</sub></td>
-<td><a href="docs/screenshots/v2/owners.png"><img src="docs/screenshots/v2/owners.png" width="270" alt="Owners"></a><br><b>Owners</b><br><sub>Cert ownership with team assignment</sub></td>
-<td><a href="docs/screenshots/v2/teams.png"><img src="docs/screenshots/v2/teams.png" width="270" alt="Teams"></a><br><b>Teams</b><br><sub>Org grouping for notification routing</sub></td>
+<td><a href="docs/screenshots/v2-targets.png"><img src="docs/screenshots/v2-targets.png" width="270" alt="Targets"></a><br><b>Targets</b><br><sub>NGINX, Apache, HAProxy deployment</sub></td>
+<td><a href="docs/screenshots/v2-owners.png"><img src="docs/screenshots/v2-owners.png" width="270" alt="Owners"></a><br><b>Owners</b><br><sub>Cert ownership with team assignment</sub></td>
+<td><a href="docs/screenshots/v2-teams.png"><img src="docs/screenshots/v2-teams.png" width="270" alt="Teams"></a><br><b>Teams</b><br><sub>Org grouping for notification routing</sub></td>
 </tr>
 <tr>
-<td><a href="docs/screenshots/v2/agent-groups.png"><img src="docs/screenshots/v2/agent-groups.png" width="270" alt="Agent Groups"></a><br><b>Agent Groups</b><br><sub>Dynamic grouping by OS, arch, CIDR</sub></td>
-<td><a href="docs/screenshots/v2/audit-trail.png"><img src="docs/screenshots/v2/audit-trail.png" width="270" alt="Audit Trail"></a><br><b>Audit Trail</b><br><sub>Immutable log, CSV/JSON export</sub></td>
-<td><a href="docs/screenshots/v2/short-lived.png"><img src="docs/screenshots/v2/short-lived.png" width="270" alt="Short-Lived"></a><br><b>Short-Lived Creds</b><br><sub>Ephemeral certs with live TTL countdown</sub></td>
+<td><a href="docs/screenshots/v2-agent-groups.png"><img src="docs/screenshots/v2-agent-groups.png" width="270" alt="Agent Groups"></a><br><b>Agent Groups</b><br><sub>Dynamic grouping by OS, arch, CIDR</sub></td>
+<td><a href="docs/screenshots/v2-audit-trail.png"><img src="docs/screenshots/v2-audit-trail.png" width="270" alt="Audit Trail"></a><br><b>Audit Trail</b><br><sub>Immutable log, CSV/JSON export</sub></td>
+<td><a href="docs/screenshots/v2-short-lived.png"><img src="docs/screenshots/v2-short-lived.png" width="270" alt="Short-Lived"></a><br><b>Short-Lived Creds</b><br><sub>Ephemeral certs with live TTL countdown</sub></td>
 </tr>
 </table>

@@ -222,6 +220,8 @@ All server environment variables use the `CERTCTL_` prefix:
 | `CERTCTL_KEYGEN_MODE` | `agent` | Key generation mode: `agent` (production) or `server` (demo only) |
 | `CERTCTL_ACME_DIRECTORY_URL` | — | ACME directory URL (e.g., Let's Encrypt staging) |
 | `CERTCTL_ACME_EMAIL` | — | Contact email for ACME account registration |
+| `CERTCTL_ACME_EAB_KID` | — | External Account Binding Key ID (required by ZeroSSL, Google Trust Services, SSL.com) |
+| `CERTCTL_ACME_EAB_HMAC` | — | External Account Binding HMAC key (base64url-encoded) |
 | `CERTCTL_ACME_CHALLENGE_TYPE` | — | ACME challenge type: `http-01` (default), `dns-01`, or `dns-persist-01` |
 | `CERTCTL_CA_CERT_PATH` | — | Path to CA certificate for sub-CA mode |
 | `CERTCTL_CA_KEY_PATH` | — | Path to CA private key for sub-CA mode |
@@ -97,11 +97,14 @@ func main() {
 	localCA := local.New(localCAConfig, logger)
 	logger.Info("initialized Local CA issuer connector")

-	// Initialize ACME issuer connector (for Let's Encrypt, Sectigo, etc.)
+	// Initialize ACME issuer connector (for Let's Encrypt, ZeroSSL, Sectigo, Google Trust Services, etc.)
 	// Supports HTTP-01 (default), DNS-01 (for wildcards), and DNS-PERSIST-01 (standing record) challenge types.
+	// EAB (External Account Binding) required by ZeroSSL, Google Trust Services, SSL.com.
 	acmeConnector := acmeissuer.New(&acmeissuer.Config{
 		DirectoryURL:           os.Getenv("CERTCTL_ACME_DIRECTORY_URL"),
 		Email:                  os.Getenv("CERTCTL_ACME_EMAIL"),
+		EABKid:                 os.Getenv("CERTCTL_ACME_EAB_KID"),
+		EABHmac:                os.Getenv("CERTCTL_ACME_EAB_HMAC"),
 		ChallengeType:          os.Getenv("CERTCTL_ACME_CHALLENGE_TYPE"),
 		DNSPresentScript:       os.Getenv("CERTCTL_ACME_DNS_PRESENT_SCRIPT"),
 		DNSCleanUpScript:       os.Getenv("CERTCTL_ACME_DNS_CLEANUP_SCRIPT"),
@@ -1,5 +1,41 @@
 # Architecture Guide

+## Contents
+
+1. [Overview](#overview)
+2. [System Components](#system-components)
+   - [Control Plane (Server)](#control-plane-server)
+   - [Agents](#agents)
+   - [Web Dashboard](#web-dashboard)
+   - [PostgreSQL Database](#postgresql-database)
+3. [Data Flow: Certificate Lifecycle](#data-flow-certificate-lifecycle)
+   - [Create Managed Certificate](#1-create-managed-certificate)
+   - [Certificate Issuance](#2-certificate-issuance)
+   - [Deploy Certificate to Target](#3-deploy-certificate-to-target)
+   - [Revoke a Certificate](#35-revoke-a-certificate)
+   - [Automatic Renewal](#4-automatic-renewal)
+4. [Connector Architecture](#connector-architecture)
+   - [IssuerConnectorAdapter (Dependency Inversion)](#issuerconnectoradapter-dependency-inversion)
+   - [Issuer Connector](#issuer-connector)
+   - [Target Connector](#target-connector)
+   - [Notifier Connector](#notifier-connector)
+   - [EST Server (RFC 7030)](#est-server-rfc-7030)
+5. [Security Model](#security-model)
+   - [Private Key Management](#private-key-management)
+   - [Authentication](#authentication)
+   - [Audit Trail](#audit-trail)
+   - [API Audit Log](#api-audit-log)
+   - [Logging](#logging)
+6. [API Design](#api-design)
+7. [MCP Server](#mcp-server)
+8. [CLI Tool](#cli-tool)
+9. [Deployment Topologies](#deployment-topologies)
+   - [Docker Compose (Development / Small Deployments)](#docker-compose-development--small-deployments)
+   - [Production (Kubernetes)](#production-kubernetes)
+10. [Discovery Data Flow (M18b + M21)](#discovery-data-flow-m18b--m21)
+11. [Testing Strategy](#testing-strategy)
+12. [What's Next](#whats-next)
+
 ## Overview

 Certctl is a certificate management platform with a **decoupled control-plane and agent architecture**. The control plane orchestrates certificate issuance and renewal, while agents deployed across your infrastructure handle key generation, certificate deployment, and local validation — private keys never leave the infrastructure they were generated on.
@@ -41,7 +77,7 @@ flowchart TB

    subgraph "Issuer Backends"
        CA1["Local CA\n(crypto/x509, sub-CA)"]
-        CA2["ACME\n(HTTP-01 + DNS-01 + DNS-PERSIST-01)"]
+        CA2["ACME\n(HTTP-01 + DNS-01 + DNS-PERSIST-01)\n(EAB, ZeroSSL auto-EAB)"]
        CA3["step-ca\n(/sign API)"]
        CA4["OpenSSL / Custom CA\n(script-based)"]
        CA6["Vault PKI\n(planned)"]
@@ -99,7 +135,7 @@ The dashboard includes an **ErrorBoundary component** for graceful error recover
 **Tech decisions**:
 - Vite for fast builds and HMR during development
 - TanStack Query over manual fetch/useEffect for automatic cache invalidation and refetching
- Dark theme default (ops teams live in dark mode)
+- Light content area with branded dark teal sidebar, Inter + JetBrains Mono typography
 - SSE/WebSocket planned for real-time job status updates

 ### PostgreSQL Database
@@ -527,7 +563,7 @@ type Connector interface {
 }
 ```

-Built-in issuers: **Local CA** (self-signed or sub-CA mode using `crypto/x509`), **ACME v2** (HTTP-01, DNS-01, and DNS-PERSIST-01 challenges, compatible with Let's Encrypt, Sectigo, and any ACME-compliant CA), **step-ca** (Smallstep private CA via native /sign API with JWK provisioner auth), and **OpenSSL/Custom CA** (script-based signing delegating to user-provided shell scripts). The ACME connector uses `golang.org/x/crypto/acme`, generates an ECDSA P-256 account key, handles account registration with ToS acceptance, order creation, challenge solving (HTTP-01 via built-in server, DNS-01 via script-based hooks, DNS-PERSIST-01 via standing TXT records with auto-fallback to DNS-01), order finalization, and DER-to-PEM chain conversion. The interface also includes `GetCACertPEM(ctx)` for CA chain distribution (used by the EST server's `/cacerts` endpoint).
+Built-in issuers: **Local CA** (self-signed or sub-CA mode using `crypto/x509`), **ACME v2** (HTTP-01, DNS-01, and DNS-PERSIST-01 challenges, compatible with Let's Encrypt, ZeroSSL, Sectigo, Google Trust Services, and any ACME-compliant CA), **step-ca** (Smallstep private CA via native /sign API with JWK provisioner auth), and **OpenSSL/Custom CA** (script-based signing delegating to user-provided shell scripts). The ACME connector uses `golang.org/x/crypto/acme`, generates an ECDSA P-256 account key, handles account registration with ToS acceptance and optional External Account Binding (EAB) for CAs that require it (ZeroSSL, Google Trust Services, SSL.com), order creation, challenge solving (HTTP-01 via built-in server, DNS-01 via script-based hooks, DNS-PERSIST-01 via standing TXT records with auto-fallback to DNS-01), order finalization, and DER-to-PEM chain conversion. For ZeroSSL, EAB credentials are auto-fetched from ZeroSSL's public API when the directory URL is detected as ZeroSSL and no EAB credentials are provided — zero-friction onboarding with no dashboard visit required. The interface also includes `GetCACertPEM(ctx)` for CA chain distribution (used by the EST server's `/cacerts` endpoint).

 ### Target Connector

@@ -2,6 +2,24 @@

 NIST SP 800-57 Part 1 Rev 5 (May 2020) is the authoritative US government guidance on cryptographic key management. This document maps certctl's implementation to its recommendations. certctl follows NIST guidance where applicable; this guide documents the alignment and identifies gaps for future roadmap planning.

+## Contents
+
+1. [Key Generation (Section 6.1)](#key-generation-section-61)
+2. [Key Storage and Protection (Sections 6.3, 6.4)](#key-storage-and-protection-sections-63-64)
+3. [Cryptoperiods (Section 5.3, Table 1)](#cryptoperiods-section-53-table-1)
+4. [Key States and Transitions (Section 5.2)](#key-states-and-transitions-section-52)
+5. [Algorithm Recommendations (Section 5.1, SP 800-131A)](#algorithm-recommendations-section-51-sp-800-131a)
+6. [Key Distribution and Transport (Section 6.2)](#key-distribution-and-transport-section-62)
+7. [Revocation and Compromise (NIST SP 800-57 Part 3)](#revocation-and-compromise-nist-sp-800-57-part-3)
+8. [Alignment Summary Table](#alignment-summary-table)
+9. [Gaps and Remediation Roadmap](#gaps-and-remediation-roadmap)
+   - [V2 (Current)](#v2-current)
+   - [V3 (Planned: 2026)](#v3-planned-2026)
+   - [V5 (Planned: 2027+)](#v5-planned-2027)
+   - [Post-Quantum (2027+)](#post-quantum-2027)
+10. [References](#references)
+11. [Questions or Corrections?](#questions-or-corrections)
+
 ## Key Generation (Section 6.1)

 certctl generates certificate keys on agent infrastructure using Go's `crypto/rand` for entropy, backed by `/dev/urandom` on Linux and `CryptGenRandom` on Windows. Key generation happens as follows:
@@ -4,6 +4,34 @@ This guide maps certctl's existing capabilities to PCI-DSS 4.0 requirements rele

 Organizations subject to PCI-DSS typically need to demonstrate control over certificate issuance, renewal, rotation, revocation, and key management. Certctl automates the technical controls for certificate lifecycle; compliance depends on how you deploy, monitor, and audit it.

+## Contents
+
+1. [How to Use This Guide](#how-to-use-this-guide)
+2. [Requirement 4: Protect Data in Transit](#requirement-4-protect-data-in-transit)
+   - [4.2.1 — Strong Cryptography for Transmission](#421--strong-cryptography-for-transmission)
+   - [4.2.2 — Certificate Inventory and Validation](#422--certificate-inventory-and-validation)
+3. [Requirement 3: Protect Stored Cardholder Data (Key Management)](#requirement-3-protect-stored-cardholder-data-key-management)
+   - [3.6 — Cryptographic Key Documentation](#36--cryptographic-key-documentation)
+   - [3.7 — Key Lifecycle Procedures](#37--key-lifecycle-procedures)
+4. [Requirement 8: Identify and Authenticate](#requirement-8-identify-and-authenticate)
+   - [8.3 — Strong Authentication](#83--strong-authentication)
+   - [8.6 — Application Account Management](#86--application-account-management)
+5. [Requirement 10: Log and Monitor](#requirement-10-log-and-monitor)
+   - [10.2 — Implement Automated Audit Logging](#102--implement-automated-audit-logging)
+   - [10.3 — Protect Audit Trail](#103--protect-audit-trail)
+   - [10.4 — Promptly Review and Address Audit Trail Exceptions](#104--promptly-review-and-address-audit-trail-exceptions)
+   - [10.7 — Retain and Protect Audit Trail History](#107--retain-and-protect-audit-trail-history)
+6. [Requirement 6: Develop and Maintain Secure Systems and Applications](#requirement-6-develop-and-maintain-secure-systems-and-applications)
+   - [6.3.1 — Security Coding Practices](#631--security-coding-practices)
+   - [6.5.10 — Broken Authentication and Cryptography Prevention](#6510--broken-authentication-and-cryptography-prevention)
+7. [Requirement 7: Restrict Access by Business Need-to-Know](#requirement-7-restrict-access-by-business-need-to-know)
+   - [7.2 — Implement Access Control](#72--implement-access-control)
+8. [Evidence Summary Table](#evidence-summary-table)
+9. [Operator Responsibilities](#operator-responsibilities)
+10. [V3 Enhancements for PCI-DSS](#v3-enhancements-for-pci-dss)
+11. [Next Steps for Compliance](#next-steps-for-compliance)
+12. [Questions?](#questions)
+
 ## How to Use This Guide

 Your QSA will request evidence that your certificate and key management systems meet specific PCI-DSS 4.0 requirements. For each applicable requirement, this guide identifies:
@@ -14,6 +14,28 @@ Each section includes:
 - **V2 vs V3 status** — whether feature is in the free community edition (V2) or paid Pro edition (V3)
 - **Operator responsibility** — aspects your organization must handle outside of certctl

+## Contents
+
+1. [How to Use This Guide](#how-to-use-this-guide)
+2. [CC6: Logical and Physical Access Controls](#cc6-logical-and-physical-access-controls)
+   - [CC6.1 — Logical Access Security](#cc61--logical-access-security)
+   - [CC6.2 — Prior to Issuing System Credentials](#cc62--prior-to-issuing-system-credentials)
+   - [CC6.3 — Authentication Policies](#cc63--authentication-policies)
+   - [CC6.7 — Information Transmission Protection](#cc67--information-transmission-protection)
+3. [CC7: System Operations](#cc7-system-operations)
+   - [CC7.1 — System Monitoring](#cc71--system-monitoring)
+   - [CC7.2 — Anomaly Detection](#cc72--anomaly-detection)
+   - [CC7.3 — Incident Response](#cc73--incident-response)
+   - [CC7.4 — Identify and Develop Risk Mitigation Activities](#cc74--identify-and-develop-risk-mitigation-activities)
+4. [A1: Availability](#a1-availability)
+   - [A1.1/A1.2 — Availability and Recovery](#a11a12--availability-and-recovery)
+5. [CC8: Change Management](#cc8-change-management)
+   - [CC8.1 — Change Control](#cc81--change-control)
+6. [Evidence Summary Table](#evidence-summary-table)
+7. [What Requires Operator Action](#what-requires-operator-action)
+8. [V3 Enhancements](#v3-enhancements)
+9. [Conclusion](#conclusion)
+
 ## CC6: Logical and Physical Access Controls

 ### CC6.1 — Logical Access Security
@@ -2,6 +2,41 @@

 If you've never worked with TLS certificates before, this guide will get you up to speed. By the end, you'll understand what certificates are, why they matter, and why the industry's move toward shorter certificate lifespans — down to 47 days by 2029 — makes automated lifecycle management essential.

+## Contents
+
+1. [What Is a TLS Certificate?](#what-is-a-tls-certificate)
+2. [Why Do Certificates Expire?](#why-do-certificates-expire)
+3. [The Cast of Characters](#the-cast-of-characters)
+   - [Certificate Authority (CA)](#certificate-authority-ca)
+   - [ACME Protocol](#acme-protocol)
+   - [EST Protocol (Enrollment over Secure Transport)](#est-protocol-enrollment-over-secure-transport)
+   - [Private Key](#private-key)
+   - [Subject Alternative Names (SANs)](#subject-alternative-names-sans)
+   - [Certificate Chain](#certificate-chain)
+4. [How certctl Works](#how-certctl-works)
+   - [The Control Plane (Server)](#the-control-plane-server)
+   - [Agents](#agents)
+   - [Deployment Targets](#deployment-targets)
+5. [The Certificate Lifecycle](#the-certificate-lifecycle)
+6. [Why Not Just Use Certbot?](#why-not-just-use-certbot)
+7. [Key Concepts in certctl](#key-concepts-in-certctl)
+   - [Teams and Owners](#teams-and-owners)
+   - [Agent Groups](#agent-groups)
+   - [Certificate Profiles](#certificate-profiles)
+   - [Interactive Renewal Approval](#interactive-renewal-approval)
+   - [Certificate Revocation](#certificate-revocation)
+   - [Short-Lived Certificates](#short-lived-certificates)
+   - [Policies](#policies)
+   - [Jobs](#jobs)
+   - [Audit Trail](#audit-trail)
+   - [Notifications](#notifications)
+   - [CLI](#cli)
+   - [MCP Server (AI Integration)](#mcp-server-ai-integration)
+   - [EST Enrollment (Device Certificates)](#est-enrollment-device-certificates)
+   - [Certificate Discovery](#certificate-discovery)
+   - [Observability](#observability)
+8. [What's Next](#whats-next)
+
 ## What Is a TLS Certificate?

 When you visit `https://yourbank.com`, your browser checks a digital document called a **TLS certificate** before sending any data. That certificate proves two things: (1) you're really talking to yourbank.com and not an imposter, and (2) everything sent between you and the server is encrypted.
@@ -2,6 +2,49 @@

 Connectors extend certctl to integrate with external systems for certificate issuance, deployment, and notifications. This guide covers the connector interfaces, built-in implementations, and how to build your own.

+## Contents
+
+1. [Overview](#overview)
+2. [Issuer Connector](#issuer-connector)
+   - [Interface](#interface)
+   - [Built-in: Local CA](#built-in-local-ca)
+   - [Built-in: ACME v2 (Let's Encrypt, Sectigo, ZeroSSL)](#built-in-acme-v2-lets-encrypt-sectigo-zerossl)
+   - [Built-in: step-ca (Smallstep Private CA)](#built-in-step-ca-smallstep-private-ca)
+   - [OpenSSL / Custom CA](#openssl--custom-ca)
+   - [Revocation Across Issuers](#revocation-across-issuers)
+   - [EST Integration (GetCACertPEM)](#est-integration-getcacertpem)
+   - [Planned Issuers](#planned-issuers)
+   - [Building a Custom Issuer](#building-a-custom-issuer)
+3. [Target Connector](#target-connector)
+   - [Interface](#interface-1)
+   - [Built-in: NGINX](#built-in-nginx)
+   - [Built-in: Apache httpd](#built-in-apache-httpd)
+   - [Built-in: HAProxy](#built-in-haproxy)
+   - [F5 BIG-IP (Interface Only)](#f5-big-ip-interface-only)
+   - [IIS (Interface Only, Dual-Mode)](#iis-interface-only-dual-mode)
+4. [Notifier Connector](#notifier-connector)
+   - [Interface](#interface-2)
+5. [Registering a Connector](#registering-a-connector)
+   - [IssuerConnectorAdapter](#issuerconnectoradapter)
+   - [Notifier Registration](#notifier-registration)
+6. [Testing Connectors](#testing-connectors)
+   - [Unit Tests](#unit-tests)
+   - [Integration Tests](#integration-tests)
+7. [Best Practices](#best-practices)
+8. [Agent Discovery Scanner](#agent-discovery-scanner)
+   - [Configuration](#configuration)
+   - [How It Works](#how-it-works)
+   - [API Endpoints](#api-endpoints)
+   - [Use Cases](#use-cases)
+9. [Network Certificate Scanner (M21)](#network-certificate-scanner-m21)
+   - [Configuration](#configuration-1)
+   - [Creating Scan Targets](#creating-scan-targets)
+   - [How It Works](#how-it-works-1)
+   - [API Endpoints](#api-endpoints-1)
+   - [Scheduler Integration](#scheduler-integration)
+   - [Use Cases](#use-cases-1)
+10. [What's Next](#whats-next)
+
 ## Overview

 Three types of connectors:
@@ -159,11 +202,35 @@ DNS-PERSIST-01 configuration:

 The present script creates a TXT record at `_validation-persist.<domain>` with the value `letsencrypt.org; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/<your-id>`. This record is permanent — no cleanup script is needed.

+ZeroSSL configuration (requires External Account Binding):
+```json
+{
+  "directory_url": "https://acme.zerossl.com/v2/DV90",
+  "email": "admin@example.com",
+  "eab_kid": "your-zerossl-eab-kid",
+  "eab_hmac": "your-zerossl-eab-hmac-base64url"
+}
+```
+
+ZeroSSL, Google Trust Services, and SSL.com require External Account Binding (EAB) for ACME account registration. For most CAs, get your EAB credentials from the CA's dashboard and provide them via `eab_kid` and `eab_hmac`. The HMAC key must be base64url-encoded (no padding). CAs that don't require EAB (Let's Encrypt, Buypass) ignore these fields.
+
+**ZeroSSL auto-EAB:** When the directory URL points to ZeroSSL and no EAB credentials are provided, certctl automatically fetches them from ZeroSSL's public API (`api.zerossl.com/acme/eab-credentials-email`) using your configured email address. No dashboard visit required — just set the directory URL and email, and it works. This is the same approach used by Caddy and acme.sh.
+
+Minimal ZeroSSL configuration (auto-EAB):
+```json
+{
+  "directory_url": "https://acme.zerossl.com/v2/DV90",
+  "email": "admin@example.com"
+}
+```
+
 DNS hook scripts receive these environment variables: `CERTCTL_DNS_DOMAIN` (domain being validated), `CERTCTL_DNS_FQDN` (full record name — `_acme-challenge.<domain>` for dns-01, `_validation-persist.<domain>` for dns-persist-01), `CERTCTL_DNS_VALUE` (TXT record value), `CERTCTL_DNS_TOKEN` (ACME challenge token). The present script must create the TXT record and exit 0; the cleanup script removes it (dns-01 only).

 Environment variables for the default ACME connector:
 - `CERTCTL_ACME_DIRECTORY_URL` — ACME directory URL
 - `CERTCTL_ACME_EMAIL` — Contact email for account registration
+- `CERTCTL_ACME_EAB_KID` — External Account Binding Key ID (required by ZeroSSL, Google Trust Services, SSL.com)
+- `CERTCTL_ACME_EAB_HMAC` — External Account Binding HMAC key (base64url-encoded)
 - `CERTCTL_ACME_CHALLENGE_TYPE` — `http-01` (default), `dns-01`, or `dns-persist-01`
 - `CERTCTL_ACME_DNS_PRESENT_SCRIPT` — Path to DNS record creation script (dns-01 and dns-persist-01)
 - `CERTCTL_ACME_DNS_CLEANUP_SCRIPT` — Path to DNS record cleanup script (dns-01 only, not used by dns-persist-01)
@@ -5,6 +5,41 @@ This demo goes beyond browsing pre-loaded data. You'll create a team, register a
 **Time**: 15-20 minutes
 **Prerequisites**: certctl running via Docker Compose (see [Quick Start](quickstart.md))

+## Contents
+
+1. [Setup](#setup)
+2. [How the pieces fit together](#how-the-pieces-fit-together)
+3. [Alternative Issuers Reference](#alternative-issuers-reference)
+   - [Sub-CA Mode](#sub-ca-mode-local-ca-chained-to-enterprise-root)
+   - [ACME with ZeroSSL](#acme-with-zerossl-auto-eab)
+   - [ACME with DNS-01 Challenges](#acme-with-dns-01-challenges-wildcard-certificates)
+   - [ACME with DNS-PERSIST-01](#acme-with-dns-persist-01-zero-touch-renewals)
+   - [step-ca (Smallstep Private CA)](#step-ca-smallstep-private-ca)
+   - [OpenSSL / Custom CA](#openssl--custom-ca-script-based)
+4. [Part 1: Build the Organization Structure](#part-1-build-the-organization-structure)
+5. [Part 2: Verify the Issuer](#part-2-verify-the-issuer)
+6. [Part 3: Create a Managed Certificate](#part-3-create-a-managed-certificate)
+7. [Part 4: Trigger Certificate Renewal](#part-4-trigger-certificate-renewal)
+8. [Part 4.5: Manage Deployment Targets](#part-45-manage-deployment-targets)
+9. [Part 5: Deploy the Certificate](#part-5-deploy-the-certificate)
+10. [Part 6: View the Audit Trail](#part-6-view-the-audit-trail-immutable-api-audit-log)
+11. [Part 7: Check Notifications](#part-7-check-notifications)
+12. [Part 8: Create a Second Certificate and Compare](#part-8-create-a-second-certificate-and-compare)
+13. [Part 8.5: Revoke a Certificate](#part-85-revoke-a-certificate)
+14. [Part 9: Policy Violations](#part-9-policy-violations)
+15. [Part 9.5: Dashboard Stats and Metrics](#part-95-dashboard-stats-and-metrics)
+16. [Part 10: Certificate Profiles](#part-10-certificate-profiles)
+17. [Part 11: Agent Groups](#part-11-agent-groups)
+18. [Part 12: Interactive Approval Workflow](#part-12-interactive-approval-workflow)
+19. [Part 13: Advanced Query Features](#part-13-advanced-query-features)
+20. [Part 14: CLI Tool](#part-14-cli-tool-m16b)
+21. [Part 15: MCP Server for AI Integration](#part-15-mcp-server-for-ai-integration-m18a)
+22. [Part 16: Certificate Discovery](#part-16-certificate-discovery-m18b--m21)
+23. [End-to-End Architecture Summary](#end-to-end-architecture-summary)
+24. [Full Automated Script](#full-automated-script)
+25. [What to Show Stakeholders](#what-to-show-stakeholders)
+26. [Teardown](#teardown)
+
 ## Setup

 Make sure certctl is running:
@@ -62,6 +97,27 @@ docker compose -f deploy/docker-compose.yml restart server

 The CA key can be RSA, ECDSA, or PKCS#8 format. The connector validates that the certificate has `IsCA=true` and `KeyUsageCertSign`.

+### ACME with ZeroSSL (Auto-EAB)
+
+ZeroSSL is a free ACME CA that requires External Account Binding (EAB) for account registration. certctl auto-fetches EAB credentials from ZeroSSL's public API when the directory URL is detected as ZeroSSL and no EAB credentials are provided — you just need an email address:
+
+```bash
+# Minimal config — certctl auto-fetches EAB credentials from ZeroSSL
+export CERTCTL_ACME_DIRECTORY_URL="https://acme.zerossl.com/v2/DV90"
+export CERTCTL_ACME_EMAIL="ops@example.com"
+```
+
+No dashboard visit, no manual EAB credential copy-paste. certctl calls `api.zerossl.com/acme/eab-credentials-email` with your email, gets back a KID + HMAC key, and uses them for ACME account registration automatically.
+
+If you already have EAB credentials (e.g., from the ZeroSSL dashboard or for other CAs like Google Trust Services or SSL.com), you can provide them explicitly:
+
+```bash
+export CERTCTL_ACME_DIRECTORY_URL="https://acme.zerossl.com/v2/DV90"
+export CERTCTL_ACME_EMAIL="ops@example.com"
+export CERTCTL_ACME_EAB_KID="your-key-id"
+export CERTCTL_ACME_EAB_HMAC="your-base64url-hmac-key"
+```
+
 ### ACME with DNS-01 Challenges (Wildcard Certificates)

 For Let's Encrypt or other ACME providers with wildcard support:
@@ -6,6 +6,30 @@ This guide gets you running in 5 minutes and walks you through everything certct

 New to certificates? Read the [Concepts Guide](concepts.md) first — it explains TLS, CAs, and private keys in plain language.

+## Contents
+
+1. [Prerequisites](#prerequisites)
+2. [Start Everything](#start-everything)
+3. [Open the Dashboard](#open-the-dashboard)
+4. [Explore the API](#explore-the-api)
+   - [Core operations](#core-operations)
+   - [Sorting, filtering, and pagination](#sorting-filtering-and-pagination)
+   - [Stats and metrics](#stats-and-metrics)
+5. [Create Your First Certificate](#create-your-first-certificate)
+   - [Revoke a certificate](#revoke-a-certificate)
+   - [Interactive approval workflow](#interactive-approval-workflow)
+6. [Certificate Discovery](#certificate-discovery)
+   - [Filesystem discovery (agent-based)](#filesystem-discovery-agent-based)
+   - [Network discovery (agentless)](#network-discovery-agentless)
+   - [Triage discovered certificates](#triage-discovered-certificates)
+7. [CLI Tool](#cli-tool)
+8. [MCP Server (AI Integration)](#mcp-server-ai-integration)
+9. [Demo Data Reference](#demo-data-reference)
+10. [Dashboard Demo Mode](#dashboard-demo-mode)
+11. [Presenting to Stakeholders](#presenting-to-stakeholders)
+12. [Tear Down](#tear-down)
+13. [What's Next](#whats-next)
+
 ## Prerequisites

 You need **Docker** and **Docker Compose** installed. That's it.
@@ -2,11 +2,42 @@

 Comprehensive manual testing playbook. Every test has a concrete command, an explanation of what it validates and why it matters, exact expected output, and an unambiguous pass/fail criterion.

+## Contents
+
+- [Prerequisites](#prerequisites)
+- [Part 1: Infrastructure & Deployment](#part-1-infrastructure--deployment)
+- [Part 2: Authentication & Security](#part-2-authentication--security)
+- [Part 3: Certificate Lifecycle (CRUD)](#part-3-certificate-lifecycle-crud)
+- [Part 4: Renewal Workflow](#part-4-renewal-workflow)
+- [Part 5: Revocation](#part-5-revocation)
+- [Part 6: Issuer Connectors](#part-6-issuer-connectors)
+- [Part 7: Target Connectors & Deployment](#part-7-target-connectors--deployment)
+- [Part 8: Agent Operations](#part-8-agent-operations)
+- [Part 9: Job System](#part-9-job-system)
+- [Part 10: Policies & Profiles](#part-10-policies--profiles)
+- [Part 11: Ownership, Teams & Agent Groups](#part-11-ownership-teams--agent-groups)
+- [Part 12: Notifications](#part-12-notifications)
+- [Part 13: Observability](#part-13-observability)
+- [Part 14: Audit Trail](#part-14-audit-trail)
+- [Part 15: Certificate Discovery (Filesystem + Network)](#part-15-certificate-discovery-filesystem--network)
+- [Part 16: Enhanced Query API](#part-16-enhanced-query-api)
+- [Part 17: CLI Tool](#part-17-cli-tool)
+- [Part 18: MCP Server](#part-18-mcp-server)
+- [Part 19: GUI Testing](#part-19-gui-testing)
+- [Part 20: Background Scheduler](#part-20-background-scheduler)
+- [Part 21: Error Handling](#part-21-error-handling)
+- [Part 22: Performance Spot Checks](#part-22-performance-spot-checks)
+- [Part 23: Structured Logging Verification](#part-23-structured-logging-verification)
+- [Part 24: Documentation Verification](#part-24-documentation-verification)
+- [Part 25: Regression Tests](#part-25-regression-tests)
+- [Part 26: EST Server (RFC 7030)](#part-26-est-server-rfc-7030)
+- [Release Sign-Off](#release-sign-off)
+
 ---

 ## Prerequisites

-### Why manual QA on top of 900+ automated tests?
+### Why manual QA on top of automated tests?

 Automated tests mock dependencies and run in isolation. Manual QA validates the full integrated stack: real PostgreSQL, real HTTP, real agent binary, real file I/O, real scheduler timing. It catches issues that unit tests can't: migration ordering, Docker networking, env var parsing, browser rendering, and timing-dependent scheduler behavior.

@@ -1423,6 +1454,62 @@ curl -s -w "\nHTTP %{http_code}\n" -X POST -H "$AUTH" -H "$CT" \

 ---

+### 6.2 ACME DNS Challenge Configuration
+
+**Test 6.2.1 — List ACME issuer with DNS-01 configuration**
+
+```bash
+curl -s -H "$AUTH" "$SERVER/api/v1/issuers/iss-acme-le" | jq '{id, type, config}'
+```
+
+**What:** Retrieves the ACME Let's Encrypt issuer and verifies its configuration.
+**Why:** ACME issuers configured for DNS-01 challenges need their solver scripts accessible for wildcard certificate support.
+**Expected:** HTTP 200. `type` = "acme". `config` may include challenge type and DNS script paths.
+**PASS if** HTTP 200 and type matches. **FAIL** otherwise.
+
+---
+
+**Test 6.2.2 — Create ACME issuer with DNS-PERSIST-01**
+
+Edit `deploy/docker-compose.yml` to set environment variables for ACME DNS-PERSIST-01:
+- `CERTCTL_ACME_CHALLENGE_TYPE: dns-persist-01`
+- `CERTCTL_ACME_DNS_PERSIST_ISSUER_DOMAIN: le.example.com`
+- `CERTCTL_ACME_DNS_PRESENT_SCRIPT: /usr/local/bin/dns-present.sh`
+- `CERTCTL_ACME_DNS_CLEANUP_SCRIPT: /usr/local/bin/dns-cleanup.sh`
+
+Restart and verify the issuer accepts the config:
+
+```bash
+curl -s -H "$AUTH" "$SERVER/api/v1/issuers/iss-acme-le" | jq '{id, type}'
+```
+
+**What:** Verifies that ACME issuers read DNS-PERSIST-01 configuration from environment variables.
+**Why:** DNS-PERSIST-01 requires a standing TXT record per IETF draft. The issuer must know the issuer domain and support this challenge type.
+**Expected:** HTTP 200. ACME issuer still functional.
+**PASS if** HTTP 200 and issuer still works. **FAIL** if 500 or issuer broken.
+
+---
+
+**Test 6.2.3 — Configure ACME with External Account Binding (ZeroSSL)**
+
+Edit `deploy/docker-compose.yml` to set EAB environment variables:
+- `CERTCTL_ACME_DIRECTORY_URL: https://acme.zerossl.com/v2/DV90`
+- `CERTCTL_ACME_EAB_KID: your-zerossl-kid`
+- `CERTCTL_ACME_EAB_HMAC: your-base64url-hmac-key`
+
+Restart and verify the issuer accepts the config:
+
+```bash
+curl -s -H "$AUTH" "$SERVER/api/v1/issuers/iss-acme-prod" | jq '{id, type}'
+```
+
+**What:** Verifies that ACME issuers read External Account Binding credentials from environment variables.
+**Why:** ZeroSSL, Google Trust Services, and SSL.com require EAB for ACME account registration. Without EAB, account creation fails and no certificates can be issued from these CAs.
+**Expected:** HTTP 200. ACME issuer functional with EAB credentials loaded.
+**PASS if** HTTP 200 and issuer responds. **FAIL** if 500 or startup errors related to EAB.
+
+---
+
 ## Part 7: Target Connectors & Deployment

 **What this validates:** CRUD for deployment targets, including type-specific configuration for all 5 target types.
@@ -2368,8 +2455,8 @@ curl -s -H "$AUTH" "$SERVER/api/v1/metrics/prometheus" | grep -c "^# HELP"

 **What:** Counts `# HELP` comment lines (metric descriptions).
 **Why:** HELP lines are required by the Prometheus exposition format. Missing = non-compliant.
-**Expected:** Count ≥ 11 (one per metric).
-**PASS if** count ≥ 11. **FAIL** if 0.
+**Expected:** Count > 0 (one per metric).
+**PASS if** count > 0. **FAIL** if 0.

 ---

@@ -2380,12 +2467,12 @@ curl -s -H "$AUTH" "$SERVER/api/v1/metrics/prometheus" | grep -c "^# TYPE"
 ```

 **What:** Counts `# TYPE` annotations (gauge/counter declarations).
-**Expected:** Count ≥ 11.
-**PASS if** count ≥ 11. **FAIL** if 0.
+**Expected:** Count > 0.
+**PASS if** count > 0. **FAIL** if 0.

 ---

-**Test 13.3.4 — All 11 Prometheus metrics present**
+**Test 13.3.4 — All documented Prometheus metrics present**

 ```bash
 METRICS=$(curl -s -H "$AUTH" "$SERVER/api/v1/metrics/prometheus")
@@ -2395,10 +2482,10 @@ for m in certctl_certificate_total certctl_certificate_active certctl_certificat
 done
 ```

-**What:** Verifies all 11 documented Prometheus metrics are present in the output.
+**What:** Verifies all documented Prometheus metrics are present in the output.
 **Why:** Missing metrics mean missing dashboard panels in Grafana. Each metric was chosen for operational value.
 **Expected:** Each metric reports count = 1 (present).
-**PASS if** all 11 metrics show count = 1. **FAIL** if any shows 0.
+**PASS if** all metrics show count = 1. **FAIL** if any shows 0.

 ---

@@ -3298,7 +3385,7 @@ Open `http://localhost:8443` in a browser.
 | 19.6.1 | Sidebar nav | Click all sidebar links | All pages load without errors | PASS if no broken routes |
 | 19.6.2 | Logout | Click logout | Returns to login screen | PASS if login page shown |
 | 19.6.3 | 401 redirect | Expire/remove auth token | Auto-redirect to login | PASS if login page shown |
-| 19.6.4 | Dark theme | Check page styling | Dark background, readable text | PASS if theme consistent |
+| 19.6.4 | Theme consistency | Check page styling | Light content area, teal sidebar, branded colors, readable text | PASS if theme consistent across all pages |

 ---

@@ -3698,36 +3785,38 @@ docker compose logs certctl-server 2>&1 | grep -v "^certctl-server" | grep -cv "

 **What this validates:** Documentation accuracy against the running system. Claims in docs must match reality.

-**Why it matters:** Inaccurate documentation destroys trust. If the README says "21 tables" but there are 19, or "78 MCP tools" but there are 76, evaluators question everything else too.
+**Why it matters:** Inaccurate documentation destroys trust. Claims in docs must match the running system. If the README says "X features" but the code doesn't have them, evaluators question everything else too.

 | Test ID | Document | Verification | Pass/Fail Criteria |
 |---------|----------|-------------|-------------------|
-| 24.1.1 | `README.md` | Feature list matches actual capabilities. Screenshot paths resolve. Mermaid diagram says "21 tables". | PASS if all claims verified |
+| 24.1.1 | `README.md` | Feature list matches actual capabilities. Screenshot paths resolve. Mermaid diagram shows database schema tables. | PASS if all claims verified |
 | 24.1.2 | `docs/quickstart.md` | Every command in the quickstart works on a clean clone. | PASS if all commands succeed |
 | 24.1.3 | `docs/concepts.md` | Terminology matches API field names and UI labels. | PASS if terminology consistent |
-| 24.1.4 | `docs/architecture.md` | Component diagram matches `docker compose ps`. Says "21 tables", "78 MCP Tools", "900+ tests". | PASS if numbers match |
-| 24.1.5 | `docs/connectors.md` | All 5 issuer types and 5 target types documented. F5/IIS marked as stubs. | PASS if all documented |
-| 24.1.6 | `docs/features.md` | Endpoint count (93), MCP tools (78), table count (21), test count (900+) all accurate. | PASS if numbers match |
+| 24.1.4 | `docs/architecture.md` | Component diagram matches `docker compose ps`. Key components and tables documented. | PASS if accurate |
+| 24.1.5 | `docs/connectors.md` | All issuer types and target types documented. F5/IIS marked as stubs. | PASS if all documented |
+| 24.1.6 | `docs/features.md` | Feature list complete and accurate. | PASS if accurate |
 | 24.1.7 | `docs/quickstart.md` | Quick start + demo walkthrough works against fresh `docker compose up`. | PASS if all steps work |
 | 24.1.8 | `docs/demo-advanced.md` | All parts executable against running stack. Network discovery section present. | PASS if all executable |
 | 24.1.9 | `docs/compliance.md` | Framework links resolve, mapping references real features. | PASS if links work |
 | 24.1.10 | `docs/compliance-soc2.md` | API endpoints cited actually exist in the router. | PASS if endpoints exist |
 | 24.1.11 | `docs/compliance-pci-dss.md` | Claims match implementation (audit trail, revocation, key management). | PASS if claims verified |
 | 24.1.12 | `docs/compliance-nist.md` | Key management claims match agent keygen behavior. | PASS if claims verified |
-| 24.1.13 | `docs/mcp.md` | Tool count = 78, domain count = 16, setup instructions work. | PASS if numbers match |
-| 24.1.14 | `api/openapi.yaml` | Operation count = 93, matches all routes in router.go. | PASS if count matches |
+| 24.1.13 | `docs/mcp.md` | Tool coverage documented, setup instructions work. | PASS if accurate |
+| 24.1.14 | `api/openapi.yaml` | OpenAPI spec matches all routes in router.go (check operation count). | PASS if count matches |

 **Verification command for OpenAPI parity:**

 ```bash
 # Count OpenAPI operations
-grep -c "operationId:" api/openapi.yaml
+OPENAPI_OPS=$(grep -c "operationId:" api/openapi.yaml)
 # Count router registrations
-grep -c "r.Register\|r.mux.Handle" internal/api/router/router.go
+ROUTER_REGS=$(grep -c "r.Register\|r.mux.Handle" internal/api/router/router.go)
+echo "OpenAPI operations: $OPENAPI_OPS"
+echo "Router registrations: $ROUTER_REGS"
 ```

-**Expected:** Both return 93.
-**PASS if** both counts = 93. **FAIL** if mismatch.
+**Expected:** Both counts match.
+**PASS if** both counts are equal. **FAIL** if mismatch (indicates spec/code drift).

 ---

@@ -3812,14 +3901,14 @@ echo "OpenAPI operations: $(grep -c 'operationId:' api/openapi.yaml)"
 echo "Router registrations: $(grep -c 'r.Register\|r.mux.Handle' internal/api/router/router.go)"
 ```

-**What:** Counts operations in the OpenAPI spec and route registrations in the router.
-**Why:** The audit found the OpenAPI spec had 78 operations while the router had 93. This was fixed by adding 15 missing operations.
-**Expected:** Both = 93.
-**PASS if** both equal 93. **FAIL** if mismatch.
+**What:** Counts operations in the OpenAPI spec and route registrations in the router, verifying they match.
+**Why:** OpenAPI spec drift happens as endpoints are added or removed. Mismatches indicate the spec is out of date.
+**Expected:** Both counts equal.
+**PASS if** both counts match. **FAIL** if mismatch (indicates spec/code drift).

 ---

-**Test 25.1.5 — Go service tests use strings.Contains, not errors.Is**
+**Test 25.1.6 — Go service tests use strings.Contains, not errors.Is**

 ```bash
 grep -rn "errors.Is.*errors.New\|errors.Is(.*err.*errors.New" internal/service/*_test.go | wc -l
@@ -4104,5 +4193,5 @@ All 26 parts must pass before tagging v2.0.1.
 | Part 25: Regression Tests | ☐ | | | |
 | Part 26: EST Server (RFC 7030) | ☐ | | | |

-**Automated tests (900+) must also be green.** CI passing is necessary but not sufficient — this manual QA catches integration issues that isolated unit tests miss.
+**Automated tests must also be green.** CI passing is necessary but not sufficient — this manual QA catches integration issues that isolated unit tests miss.

@@ -6,12 +6,16 @@ import (
 	"crypto/elliptic"
 	"crypto/rand"
 	"crypto/x509"
+	"encoding/base64"
 	"encoding/json"
 	"encoding/pem"
 	"fmt"
+	"io"
 	"log/slog"
 	"net"
 	"net/http"
+	"net/url"
+	"strings"
 	"sync"
 	"time"

@@ -201,6 +205,33 @@ func (c *Connector) ensureClient(ctx context.Context) error {
 	acct := &acme.Account{
 		Contact: []string{"mailto:" + c.config.Email},
 	}
+
+	// Auto-fetch EAB credentials from ZeroSSL if directory URL is ZeroSSL and no EAB provided.
+	// ZeroSSL offers a public endpoint that returns EAB credentials given an email address,
+	// so users don't need to visit the ZeroSSL dashboard manually.
+	if c.config.EABKid == "" && c.config.EABHmac == "" && isZeroSSL(c.config.DirectoryURL) {
+		kid, hmac, eabErr := fetchZeroSSLEAB(ctx, c.config.Email)
+		if eabErr != nil {
+			return fmt.Errorf("failed to auto-fetch ZeroSSL EAB credentials: %w", eabErr)
+		}
+		c.config.EABKid = kid
+		c.config.EABHmac = hmac
+		c.logger.Info("auto-fetched EAB credentials from ZeroSSL", "eab_kid", kid)
+	}
+
+	// External Account Binding (required by ZeroSSL, Google Trust Services, SSL.com, etc.)
+	if c.config.EABKid != "" && c.config.EABHmac != "" {
+		hmacKey, decodeErr := base64.RawURLEncoding.DecodeString(c.config.EABHmac)
+		if decodeErr != nil {
+			return fmt.Errorf("failed to decode EAB HMAC key (expected base64url): %w", decodeErr)
+		}
+		acct.ExternalAccountBinding = &acme.ExternalAccountBinding{
+			KID: c.config.EABKid,
+			Key: hmacKey,
+		}
+		c.logger.Info("using External Account Binding for ACME registration", "eab_kid", c.config.EABKid)
+	}
+
 	_, err = c.client.Register(ctx, acct, acme.AcceptTOS)
 	if err != nil {
 		// Account may already exist, try to get it
@@ -216,6 +247,67 @@ func (c *Connector) ensureClient(ctx context.Context) error {
 	return nil
 }

+// zeroSSLEABEndpoint is the ZeroSSL API endpoint for auto-generating EAB credentials.
+// Variable (not const) to allow test overrides.
+var zeroSSLEABEndpoint = "https://api.zerossl.com/acme/eab-credentials-email"
+
+// isZeroSSL returns true if the ACME directory URL points to ZeroSSL.
+func isZeroSSL(directoryURL string) bool {
+	return strings.Contains(strings.ToLower(directoryURL), "zerossl.com")
+}
+
+// fetchZeroSSLEAB retrieves EAB credentials from ZeroSSL's public API endpoint.
+// ZeroSSL provides this so users don't need to visit the dashboard manually.
+// Returns (kid, hmac_key, error). The HMAC key is already base64url-encoded.
+func fetchZeroSSLEAB(ctx context.Context, email string) (string, string, error) {
+	if email == "" {
+		return "", "", fmt.Errorf("email is required for ZeroSSL EAB auto-fetch")
+	}
+
+	form := url.Values{"email": {email}}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, zeroSSLEABEndpoint, strings.NewReader(form.Encode()))
+	if err != nil {
+		return "", "", fmt.Errorf("create request: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	client := &http.Client{Timeout: 15 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return "", "", fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return "", "", fmt.Errorf("read response: %w", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return "", "", fmt.Errorf("ZeroSSL API returned status %d: %s", resp.StatusCode, string(body))
+	}
+
+	var result struct {
+		Success  bool   `json:"success"`
+		EABKid   string `json:"eab_kid"`
+		EABHmac  string `json:"eab_hmac_key"`
+		ErrorMsg string `json:"error"`
+	}
+	if err := json.Unmarshal(body, &result); err != nil {
+		return "", "", fmt.Errorf("parse response: %w", err)
+	}
+
+	if !result.Success || result.EABKid == "" || result.EABHmac == "" {
+		errDetail := result.ErrorMsg
+		if errDetail == "" {
+			errDetail = string(body)
+		}
+		return "", "", fmt.Errorf("ZeroSSL EAB generation failed: %s", errDetail)
+	}
+
+	return result.EABKid, result.EABHmac, nil
+}
+
 // IssueCertificate submits a certificate issuance request to the ACME CA.
 //
 // Flow:
@@ -0,0 +1,264 @@
+package acme
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strings"
+	"testing"
+)
+
+func testLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelError}))
+}
+
+func TestValidateConfig_MissingDirectoryURL(t *testing.T) {
+	c := New(nil, testLogger())
+	cfg, _ := json.Marshal(map[string]string{"email": "test@example.com"})
+	err := c.ValidateConfig(context.Background(), cfg)
+	if err == nil || !strings.Contains(err.Error(), "directory_url is required") {
+		t.Fatalf("expected directory_url error, got: %v", err)
+	}
+}
+
+func TestValidateConfig_MissingEmail(t *testing.T) {
+	c := New(nil, testLogger())
+	cfg, _ := json.Marshal(map[string]string{"directory_url": "https://example.com/directory"})
+	err := c.ValidateConfig(context.Background(), cfg)
+	if err == nil || !strings.Contains(err.Error(), "email is required") {
+		t.Fatalf("expected email error, got: %v", err)
+	}
+}
+
+func TestValidateConfig_InvalidChallengeType(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		fmt.Fprint(w, `{"newNonce":"","newAccount":"","newOrder":""}`)
+	}))
+	defer srv.Close()
+
+	c := New(nil, testLogger())
+	cfg, _ := json.Marshal(map[string]string{
+		"directory_url":  srv.URL,
+		"email":          "test@example.com",
+		"challenge_type": "invalid-challenge",
+	})
+	err := c.ValidateConfig(context.Background(), cfg)
+	if err == nil || !strings.Contains(err.Error(), "invalid challenge_type") {
+		t.Fatalf("expected invalid challenge_type error, got: %v", err)
+	}
+}
+
+func TestValidateConfig_Success(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		fmt.Fprint(w, `{"newNonce":"","newAccount":"","newOrder":""}`)
+	}))
+	defer srv.Close()
+
+	c := New(nil, testLogger())
+	cfg, _ := json.Marshal(map[string]string{
+		"directory_url": srv.URL,
+		"email":         "test@example.com",
+	})
+	err := c.ValidateConfig(context.Background(), cfg)
+	if err != nil {
+		t.Fatalf("expected success, got: %v", err)
+	}
+}
+
+func TestValidateConfig_EABFieldsPreserved(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		fmt.Fprint(w, `{"newNonce":"","newAccount":"","newOrder":""}`)
+	}))
+	defer srv.Close()
+
+	c := New(nil, testLogger())
+	cfg, _ := json.Marshal(map[string]string{
+		"directory_url": srv.URL,
+		"email":         "test@example.com",
+		"eab_kid":       "kid-12345",
+		"eab_hmac":      base64.RawURLEncoding.EncodeToString([]byte("test-hmac-key")),
+	})
+	err := c.ValidateConfig(context.Background(), cfg)
+	if err != nil {
+		t.Fatalf("expected success, got: %v", err)
+	}
+	if c.config.EABKid != "kid-12345" {
+		t.Fatalf("expected EABKid to be preserved, got: %s", c.config.EABKid)
+	}
+	if c.config.EABHmac == "" {
+		t.Fatal("expected EABHmac to be preserved")
+	}
+}
+
+func TestEnsureClient_EABDecodeError(t *testing.T) {
+	c := New(&Config{
+		DirectoryURL: "https://acme.example.com/directory",
+		Email:        "test@example.com",
+		EABKid:       "kid-12345",
+		EABHmac:      "!!!not-valid-base64url!!!",
+	}, testLogger())
+
+	err := c.ensureClient(context.Background())
+	if err == nil || !strings.Contains(err.Error(), "decode EAB HMAC") {
+		t.Fatalf("expected EAB decode error, got: %v", err)
+	}
+}
+
+func TestEnsureClient_EABBindingSet(t *testing.T) {
+	// We can't fully mock the ACME protocol (JWS nonce exchange), but we can
+	// verify that valid EAB credentials are decoded and attached to the account
+	// without panicking. The ensureClient call will fail at the network level
+	// (no real ACME server), but it must NOT fail at EAB decoding.
+	hmacKey := base64.RawURLEncoding.EncodeToString([]byte("test-hmac-secret-key"))
+	c := New(&Config{
+		DirectoryURL: "https://127.0.0.1:1/directory", // unreachable — that's fine
+		Email:        "test@example.com",
+		EABKid:       "kid-zerossl-12345",
+		EABHmac:      hmacKey,
+	}, testLogger())
+
+	err := c.ensureClient(context.Background())
+	// Expected: network error (unreachable server), NOT an EAB decode error
+	if err != nil && strings.Contains(err.Error(), "decode EAB HMAC") {
+		t.Fatalf("EAB decode should not fail with valid base64url key, got: %v", err)
+	}
+	// We expect some error (network unreachable) — that's correct
+	if err == nil {
+		t.Log("ensureClient succeeded (unexpected but not a failure for this test)")
+	}
+}
+
+// --- ZeroSSL auto-EAB tests ---
+
+func TestIsZeroSSL(t *testing.T) {
+	tests := []struct {
+		url    string
+		expect bool
+	}{
+		{"https://acme.zerossl.com/v2/DV90", true},
+		{"https://ACME.ZEROSSL.COM/v2/DV90", true},
+		{"https://acme-v02.api.letsencrypt.org/directory", false},
+		{"https://acme.example.com/directory", false},
+		{"", false},
+	}
+	for _, tt := range tests {
+		if got := isZeroSSL(tt.url); got != tt.expect {
+			t.Errorf("isZeroSSL(%q) = %v, want %v", tt.url, got, tt.expect)
+		}
+	}
+}
+
+func TestFetchZeroSSLEAB_Success(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost {
+			t.Errorf("expected POST, got %s", r.Method)
+		}
+		if ct := r.Header.Get("Content-Type"); ct != "application/x-www-form-urlencoded" {
+			t.Errorf("expected form content-type, got %s", ct)
+		}
+		if err := r.ParseForm(); err != nil {
+			t.Fatal(err)
+		}
+		if email := r.FormValue("email"); email != "test@example.com" {
+			t.Errorf("expected email test@example.com, got %s", email)
+		}
+		w.Header().Set("Content-Type", "application/json")
+		fmt.Fprint(w, `{"success":true,"eab_kid":"kid_abc123","eab_hmac_key":"dGVzdC1obWFjLWtleQ"}`)
+	}))
+	defer srv.Close()
+
+	// Override the endpoint for testing
+	origEndpoint := zeroSSLEABEndpoint
+	defer func() { zeroSSLEABEndpoint = origEndpoint }()
+	zeroSSLEABEndpoint = srv.URL
+
+	kid, hmac, err := fetchZeroSSLEAB(context.Background(), "test@example.com")
+	if err != nil {
+		t.Fatalf("expected success, got: %v", err)
+	}
+	if kid != "kid_abc123" {
+		t.Errorf("expected kid_abc123, got %s", kid)
+	}
+	if hmac != "dGVzdC1obWFjLWtleQ" {
+		t.Errorf("expected dGVzdC1obWFjLWtleQ, got %s", hmac)
+	}
+}
+
+func TestFetchZeroSSLEAB_EmptyEmail(t *testing.T) {
+	_, _, err := fetchZeroSSLEAB(context.Background(), "")
+	if err == nil || !strings.Contains(err.Error(), "email is required") {
+		t.Fatalf("expected email required error, got: %v", err)
+	}
+}
+
+func TestFetchZeroSSLEAB_APIError(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusBadRequest)
+		fmt.Fprint(w, `{"success":false,"error":"invalid email"}`)
+	}))
+	defer srv.Close()
+
+	origEndpoint := zeroSSLEABEndpoint
+	defer func() { zeroSSLEABEndpoint = origEndpoint }()
+	zeroSSLEABEndpoint = srv.URL
+
+	_, _, err := fetchZeroSSLEAB(context.Background(), "bad@example.com")
+	if err == nil || !strings.Contains(err.Error(), "status 400") {
+		t.Fatalf("expected API error, got: %v", err)
+	}
+}
+
+func TestFetchZeroSSLEAB_MissingCredentials(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		fmt.Fprint(w, `{"success":false,"error":"rate limited"}`)
+	}))
+	defer srv.Close()
+
+	origEndpoint := zeroSSLEABEndpoint
+	defer func() { zeroSSLEABEndpoint = origEndpoint }()
+	zeroSSLEABEndpoint = srv.URL
+
+	_, _, err := fetchZeroSSLEAB(context.Background(), "test@example.com")
+	if err == nil || !strings.Contains(err.Error(), "EAB generation failed") {
+		t.Fatalf("expected EAB generation failed error, got: %v", err)
+	}
+}
+
+func TestEnsureClient_ZeroSSLAutoEAB(t *testing.T) {
+	// Mock ZeroSSL EAB endpoint
+	eabSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		fmt.Fprint(w, `{"success":true,"eab_kid":"auto-kid-123","eab_hmac_key":"dGVzdC1obWFjLWtleQ"}`)
+	}))
+	defer eabSrv.Close()
+
+	origEndpoint := zeroSSLEABEndpoint
+	defer func() { zeroSSLEABEndpoint = origEndpoint }()
+	zeroSSLEABEndpoint = eabSrv.URL
+
+	// Use an unreachable ACME directory — we only care that auto-EAB fetch happens
+	c := New(&Config{
+		DirectoryURL: "https://acme.zerossl.com/v2/DV90",
+		Email:        "test@example.com",
+		// EABKid and EABHmac intentionally empty — should auto-fetch
+	}, testLogger())
+
+	err := c.ensureClient(context.Background())
+	// Will fail at ACME protocol level (unreachable ZeroSSL directory), but
+	// EAB credentials should have been auto-fetched and set on config
+	if c.config.EABKid != "auto-kid-123" {
+		t.Errorf("expected auto-fetched EABKid, got: %s (err: %v)", c.config.EABKid, err)
+	}
+	if c.config.EABHmac != "dGVzdC1obWFjLWtleQ" {
+		t.Errorf("expected auto-fetched EABHmac, got: %s", c.config.EABHmac)
+	}
+}
@@ -937,6 +937,61 @@ func generateE2ECSRBase64DER(t *testing.T, cn string, sans []string) string {
 	return base64.StdEncoding.EncodeToString(csrDER)
 }

+// TestPrometheusMetrics exercises the Prometheus metrics endpoint (M22).
+func TestPrometheusMetrics(t *testing.T) {
+	server, _, _, _ := setupTestServer(t)
+
+	t.Run("GetPrometheusMetrics_Success", func(t *testing.T) {
+		resp, err := http.Get(server.URL + "/api/v1/metrics/prometheus")
+		if err != nil {
+			t.Fatalf("request failed: %v", err)
+		}
+		defer resp.Body.Close()
+
+		if resp.StatusCode != http.StatusOK {
+			bodyBytes, _ := io.ReadAll(resp.Body)
+			t.Fatalf("expected 200, got %d: %s", resp.StatusCode, string(bodyBytes))
+		}
+
+		// Verify Content-Type contains text/plain
+		contentType := resp.Header.Get("Content-Type")
+		if !strings.Contains(contentType, "text/plain") {
+			t.Errorf("expected Content-Type containing 'text/plain', got %s", contentType)
+		}
+
+		// Read and verify Prometheus format
+		body, _ := io.ReadAll(resp.Body)
+		bodyStr := string(body)
+
+		// Should contain HELP and TYPE lines for metrics
+		if !strings.Contains(bodyStr, "# HELP") {
+			t.Error("expected HELP line in Prometheus response")
+		}
+		if !strings.Contains(bodyStr, "# TYPE") {
+			t.Error("expected TYPE line in Prometheus response")
+		}
+
+		// Should contain metric lines (gauge, counter, uptime)
+		if !strings.Contains(bodyStr, "certctl_") {
+			t.Error("expected certctl_ prefixed metrics in response")
+		}
+
+		t.Logf("Prometheus metrics endpoint working, body size: %d bytes", len(bodyStr))
+	})
+
+	t.Run("GetPrometheusMetrics_MethodNotAllowed", func(t *testing.T) {
+		resp, err := http.Post(server.URL+"/api/v1/metrics/prometheus", "application/json", nil)
+		if err != nil {
+			t.Fatalf("request failed: %v", err)
+		}
+		defer resp.Body.Close()
+
+		if resp.StatusCode != http.StatusMethodNotAllowed {
+			t.Errorf("expected 405, got %d", resp.StatusCode)
+		}
+	})
+}
+
 // TestESTEndpoints exercises the EST (RFC 7030) enrollment endpoints end-to-end (M23).
 func TestESTEndpoints(t *testing.T) {
 	server, _, _, _ := setupTestServer(t)
@@ -804,4 +804,3 @@ func TestRevocationEndpoints(t *testing.T) {
 	})
 }

-// mockNetworkScanService is defined in lifecycle_test.go (same package)
@@ -7,10 +7,10 @@ export default function AuthGate({ children }: { children: ReactNode }) {

  if (loading) {
    return (
-      <div className="min-h-screen bg-slate-900 flex items-center justify-center">
+      <div className="min-h-screen bg-page flex items-center justify-center">
        <div className="text-center">
-          <h1 className="text-2xl font-bold text-blue-400 mb-2">certctl</h1>
-          <p className="text-sm text-slate-400">Connecting...</p>
+          <h1 className="text-2xl font-bold text-brand-500 mb-2">certctl</h1>
+          <p className="text-sm text-ink-muted">Connecting...</p>
        </div>
      </div>
    );
@@ -20,7 +20,7 @@ interface DataTableProps<T> {
 export default function DataTable<T>({ columns, data, onRowClick, emptyMessage, isLoading, keyField = 'id', selectable, selectedKeys, onSelectionChange }: DataTableProps<T>) {
  if (isLoading) {
    return (
-      <div className="flex items-center justify-center py-16 text-slate-400">
+      <div className="flex items-center justify-center py-16 text-ink-muted">
        <svg className="animate-spin h-5 w-5 mr-3" viewBox="0 0 24 24">
          <circle className="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" strokeWidth="4" fill="none" />
          <path className="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4z" />
@@ -32,7 +32,7 @@ export default function DataTable<T>({ columns, data, onRowClick, emptyMessage,

  if (!data.length) {
    return (
-      <div className="flex items-center justify-center py-16 text-slate-500">
+      <div className="flex items-center justify-center py-16 text-ink-faint">
        {emptyMessage || 'No data found'}
      </div>
    );
@@ -62,19 +62,19 @@ export default function DataTable<T>({ columns, data, onRowClick, emptyMessage,
    <div className="overflow-x-auto">
      <table className="w-full text-sm">
        <thead>
-          <tr className="border-b-2 border-slate-700">
+          <tr className="border-b-2 border-surface-border bg-surface-muted">
            {selectable && (
              <th className="px-3 py-3 w-10">
                <input
                  type="checkbox"
                  checked={allSelected || false}
                  onChange={toggleAll}
-                  className="rounded border-slate-600 bg-slate-900 text-blue-600 focus:ring-blue-500 focus:ring-offset-0 cursor-pointer"
+                  className="rounded border-surface-border bg-white text-brand-500 focus:ring-brand-500 focus:ring-offset-0 cursor-pointer"
                />
              </th>
            )}
            {columns.map(col => (
-              <th key={col.key} className={`px-4 py-3 text-left text-xs font-semibold text-slate-400 uppercase tracking-wider ${col.className || ''}`}>
+              <th key={col.key} className={`px-4 py-3 text-left text-xs font-semibold text-ink-muted uppercase tracking-wider ${col.className || ''}`}>
                {col.label}
              </th>
            ))}
@@ -88,7 +88,7 @@ export default function DataTable<T>({ columns, data, onRowClick, emptyMessage,
              <tr
                key={rowKey}
                onClick={() => onRowClick?.(item)}
-                className={`border-b border-slate-700/50 transition-colors hover:bg-blue-500/5 ${onRowClick ? 'cursor-pointer' : ''} ${isSelected ? 'bg-blue-500/10' : ''}`}
+                className={`border-b border-surface-border/50 transition-colors hover:bg-surface-muted ${onRowClick ? 'cursor-pointer' : ''} ${isSelected ? 'bg-brand-50' : ''}`}
              >
                {selectable && (
                  <td className="px-3 py-3 w-10">
@@ -97,12 +97,12 @@ export default function DataTable<T>({ columns, data, onRowClick, emptyMessage,
                      checked={isSelected || false}
                      onChange={(e) => { e.stopPropagation(); toggleOne(rowKey); }}
                      onClick={(e) => e.stopPropagation()}
-                      className="rounded border-slate-600 bg-slate-900 text-blue-600 focus:ring-blue-500 focus:ring-offset-0 cursor-pointer"
+                      className="rounded border-surface-border bg-white text-brand-500 focus:ring-brand-500 focus:ring-offset-0 cursor-pointer"
                    />
                  </td>
                )}
                {columns.map(col => (
-                  <td key={col.key} className={`px-4 py-3 ${col.className || ''}`}>
+                  <td key={col.key} className={`px-4 py-3 text-ink ${col.className || ''}`}>
                    {col.render(item)}
                  </td>
                ))}
@@ -26,10 +26,10 @@ export default class ErrorBoundary extends Component<Props, State> {
  render() {
    if (this.state.hasError) {
      return (
-        <div className="flex items-center justify-center min-h-screen bg-slate-900">
+        <div className="flex items-center justify-center min-h-screen bg-page">
          <div className="text-center p-8">
-            <h1 className="text-xl font-semibold text-red-400 mb-2">Something went wrong</h1>
-            <p className="text-sm text-slate-400 mb-4">
+            <h1 className="text-xl font-semibold text-red-700 mb-2">Something went wrong</h1>
+            <p className="text-sm text-ink-muted mb-4">
              {this.state.error?.message || 'An unexpected error occurred'}
            </p>
            <button
@@ -37,7 +37,7 @@ export default class ErrorBoundary extends Component<Props, State> {
                this.setState({ hasError: false, error: null });
                window.location.reload();
              }}
-              className="px-4 py-2 bg-blue-600 text-white rounded-lg text-sm hover:bg-blue-500"
+              className="px-4 py-2 bg-brand-500 text-white rounded text-sm hover:bg-brand-600"
            >
              Reload Page
            </button>
@@ -5,12 +5,12 @@ interface ErrorStateProps {

 export default function ErrorState({ error, onRetry }: ErrorStateProps) {
  return (
-    <div className="flex flex-col items-center justify-center py-16 text-slate-400">
-      <svg className="w-12 h-12 text-red-400 mb-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
+    <div className="flex flex-col items-center justify-center py-16 text-ink-muted">
+      <svg className="w-12 h-12 text-red-700 mb-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
        <path strokeLinecap="round" strokeLinejoin="round" d="M12 9v3.75m-9.303 3.376c-.866 1.5.217 3.374 1.948 3.374h14.71c1.73 0 2.813-1.874 1.948-3.374L13.949 3.378c-.866-1.5-3.032-1.5-3.898 0L2.697 16.126zM12 15.75h.007v.008H12v-.008z" />
      </svg>
-      <p className="text-sm mb-2">Failed to load data</p>
-      <p className="text-xs text-slate-500 mb-4">{error.message}</p>
+      <p className="text-sm mb-2 text-ink">Failed to load data</p>
+      <p className="text-xs text-ink-faint mb-4">{error.message}</p>
      {onRetry && (
        <button onClick={onRetry} className="btn btn-primary text-xs">
          Retry
@@ -1,5 +1,6 @@
 import { NavLink, Outlet } from 'react-router-dom';
 import { useAuth } from './AuthProvider';
+import logo from '../assets/certctl-logo.png';

 const nav = [
  { to: '/',              label: 'Dashboard',     icon: 'M3 12l2-2m0 0l7-7 7 7M5 10v10a1 1 0 001 1h3m10-11l2 2m-2-2v10a1 1 0 01-1 1h-3m-4 0h4' },
@@ -21,7 +22,7 @@ const nav = [

 function Icon({ d }: { d: string }) {
  return (
-    <svg className="w-5 h-5 shrink-0" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
+    <svg className="w-[18px] h-[18px] shrink-0" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
      <path strokeLinecap="round" strokeLinejoin="round" d={d} />
    </svg>
  );
@@ -32,23 +33,30 @@ export default function Layout() {

  return (
    <div className="flex h-screen overflow-hidden">
-      {/* Sidebar */}
-      <aside className="w-64 bg-slate-800 border-r border-slate-700 flex flex-col">
-        <div className="p-6 border-b border-slate-700">
-          <h1 className="text-xl font-bold text-blue-400">certctl</h1>
-          <p className="text-xs text-slate-400 uppercase tracking-wider mt-1">Certificate Control Plane</p>
+      {/* Sidebar — deep teal from logo */}
+      <aside className="w-60 bg-sidebar flex flex-col shadow-xl">
+        {/* Logo — large and prominent */}
+        <div className="px-4 pt-5 pb-4 flex flex-col items-center gap-2">
+          <div className="bg-white rounded-xl p-2 shadow-lg">
+            <img src={logo} alt="certctl" className="h-16 w-16" />
+          </div>
+          <div className="text-center">
+            <h1 className="text-lg font-bold text-white tracking-tight">certctl</h1>
+            <p className="text-[10px] text-brand-300 uppercase tracking-[0.2em]">Control Plane</p>
+          </div>
        </div>
-        <nav className="flex-1 p-4 space-y-1 overflow-y-auto">
+
+        <nav className="flex-1 py-2 px-3 space-y-0.5 overflow-y-auto">
          {nav.map(item => (
            <NavLink
              key={item.to}
              to={item.to}
              end={item.to === '/'}
              className={({ isActive }) =>
-                `flex items-center gap-3 px-3 py-2.5 rounded-lg text-sm transition-colors ${
+                `flex items-center gap-3 px-3 py-2 text-[13px] rounded transition-all duration-150 ${
                  isActive
-                    ? 'bg-blue-600 text-white'
-                    : 'text-slate-400 hover:bg-slate-700 hover:text-slate-200'
+                    ? 'bg-white/15 text-white font-semibold shadow-sm'
+                    : 'text-sidebar-text hover:text-white hover:bg-white/10'
                }`
              }
            >
@@ -57,12 +65,13 @@ export default function Layout() {
            </NavLink>
          ))}
        </nav>
-        <div className="p-4 border-t border-slate-700 flex items-center justify-between">
-          <span className="text-xs text-slate-500">certctl v1.0-dev</span>
+
+        <div className="px-5 py-3 border-t border-white/10 flex items-center justify-between">
+          <span className="text-[10px] text-brand-300/60 font-mono">v2.0.3</span>
          {authRequired && (
            <button
              onClick={logout}
-              className="text-xs text-slate-500 hover:text-slate-300 transition-colors"
+              className="text-xs text-sidebar-text hover:text-white transition-colors"
              title="Sign out"
            >
              <svg className="w-4 h-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
@@ -73,8 +82,8 @@ export default function Layout() {
        </div>
      </aside>

-      {/* Main content */}
-      <main className="flex-1 flex flex-col overflow-hidden">
+      {/* Main content — light background */}
+      <main className="flex-1 flex flex-col overflow-hidden bg-page">
        <Outlet />
      </main>
    </div>
@@ -6,10 +6,10 @@ interface PageHeaderProps {

 export default function PageHeader({ title, subtitle, action }: PageHeaderProps) {
  return (
-    <div className="flex items-center justify-between px-6 py-4 border-b border-slate-700 bg-slate-800">
+    <div className="flex items-center justify-between px-6 py-4 border-b border-surface-border bg-surface">
      <div>
-        <h2 className="text-lg font-semibold">{title}</h2>
-        {subtitle && <p className="text-sm text-slate-400 mt-0.5">{subtitle}</p>}
+        <h2 className="text-lg font-semibold text-ink">{title}</h2>
+        {subtitle && <p className="text-sm text-ink-muted mt-0.5">{subtitle}</p>}
      </div>
      {action}
    </div>
@@ -1,4 +1,5 @@
 const statusStyles: Record<string, string> = {
+  // Certificate statuses
  Active:              'badge-success',
  Expiring:            'badge-warning',
  Expired:             'badge-danger',
@@ -8,6 +9,8 @@ const statusStyles: Record<string, string> = {
  Revoked:             'badge-danger',
  // Job statuses
  Pending:             'badge-info',
+  AwaitingCSR:         'badge-info',
+  AwaitingApproval:    'badge-info',
  Running:             'badge-warning',
  Completed:           'badge-success',
  Failed:              'badge-danger',
@@ -1,30 +1,53 @@
+@import url('https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500;600&display=swap');
+
@tailwind base;
@tailwind components;
@tailwind utilities;

@layer base {
  body {
-    @apply bg-slate-900 text-slate-100 antialiased;
+    @apply bg-page text-ink antialiased;
+    font-family: 'Inter', system-ui, -apple-system, sans-serif;
  }
 }

@layer components {
+  /* Badges */
  .badge {
-    @apply inline-flex items-center px-2.5 py-0.5 rounded-full text-xs font-medium;
+    @apply inline-flex items-center px-2.5 py-0.5 rounded-full text-xs font-semibold tracking-wide;
  }
-  .badge-success { @apply bg-emerald-500/10 text-emerald-400 border border-emerald-500/20; }
-  .badge-warning { @apply bg-amber-500/10 text-amber-400 border border-amber-500/20; }
-  .badge-danger  { @apply bg-red-500/10 text-red-400 border border-red-500/20; }
-  .badge-info    { @apply bg-blue-500/10 text-blue-400 border border-blue-500/20; }
-  .badge-neutral { @apply bg-slate-500/10 text-slate-400 border border-slate-500/20; }
+  .badge-success { @apply bg-emerald-100 text-emerald-700; }
+  .badge-warning { @apply bg-amber-100 text-amber-700; }
+  .badge-danger  { @apply bg-red-100 text-red-700; }
+  .badge-info    { @apply bg-brand-100 text-brand-700; }
+  .badge-neutral { @apply bg-slate-100 text-slate-600; }

+  /* Cards */
  .card {
-    @apply bg-slate-800 border border-slate-700 rounded-lg;
+    @apply bg-surface border border-surface-border rounded-md shadow-sm;
  }

+  /* Buttons */
  .btn {
-    @apply inline-flex items-center justify-center gap-2 px-4 py-2 rounded-lg text-sm font-medium transition-colors;
+    @apply inline-flex items-center justify-center gap-2 px-4 py-2 rounded text-sm font-semibold transition-all duration-150;
+  }
+  .btn-primary { @apply bg-brand-500 hover:bg-brand-600 text-white shadow-sm; }
+  .btn-danger  { @apply bg-red-500 hover:bg-red-600 text-white shadow-sm; }
+  .btn-ghost   { @apply text-ink-muted hover:text-ink hover:bg-surface-muted; }
+  .btn-outline { @apply border border-surface-border text-ink-muted hover:text-ink hover:bg-surface-muted; }
+
+  /* Form inputs */
+  .input {
+    @apply bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink placeholder:text-ink-faint focus:border-brand-500 focus:ring-2 focus:ring-brand-500/20 outline-none transition-colors;
+  }
+
+  /* Monospace data values */
+  .mono {
+    @apply font-mono text-xs;
+  }
+
+  /* Stat cards with colored top borders */
+  .stat-card {
+    @apply bg-surface border border-surface-border rounded-md shadow-sm p-5 border-t-4;
  }
-  .btn-primary { @apply bg-blue-600 hover:bg-blue-500 text-white; }
-  .btn-ghost   { @apply hover:bg-slate-700 text-slate-300; }
 }
@@ -8,9 +8,9 @@ import { formatDateTime, timeAgo } from '../api/utils';

 function InfoRow({ label, value }: { label: string; value: React.ReactNode }) {
  return (
-    <div className="flex justify-between py-2 border-b border-slate-700/50">
-      <span className="text-sm text-slate-400">{label}</span>
-      <span className="text-sm text-slate-200">{value}</span>
+    <div className="flex justify-between py-2 border-b border-surface-border/50">
+      <span className="text-sm text-ink-muted">{label}</span>
+      <span className="text-sm text-ink">{value}</span>
    </div>
  );
 }
@@ -47,7 +47,7 @@ export default function AgentDetailPage() {
    return (
      <>
        <PageHeader title="Agent" />
-        <div className="flex items-center justify-center flex-1 text-slate-400">Loading...</div>
+        <div className="flex items-center justify-center flex-1 text-ink-muted">Loading...</div>
      </>
    );
  }
@@ -75,8 +75,8 @@ export default function AgentDetailPage() {
      <div className="flex-1 overflow-y-auto p-6 space-y-6">
        <div className="grid grid-cols-1 lg:grid-cols-2 gap-6">
          {/* Agent Info */}
-          <div className="card p-5">
-            <h3 className="text-sm font-semibold text-slate-300 mb-4">Agent Details</h3>
+          <div className="bg-surface border border-surface-border rounded p-5 shadow-sm">
+            <h3 className="text-sm font-semibold text-ink-muted mb-4">Agent Details</h3>
            <InfoRow label="Health" value={<StatusBadge status={health} />} />
            <InfoRow label="Hostname" value={<span className="font-mono text-xs">{agent.hostname || '—'}</span>} />
            <InfoRow label="IP Address" value={<span className="font-mono text-xs">{agent.ip_address || '—'}</span>} />
@@ -85,7 +85,7 @@ export default function AgentDetailPage() {
              agent.last_heartbeat ? (
                <span>
                  {timeAgo(agent.last_heartbeat)}
-                  <span className="text-slate-500 ml-2 text-xs">{formatDateTime(agent.last_heartbeat)}</span>
+                  <span className="text-ink-faint ml-2 text-xs">{formatDateTime(agent.last_heartbeat)}</span>
                </span>
              ) : '—'
            } />
@@ -94,15 +94,15 @@ export default function AgentDetailPage() {
          </div>

          {/* System Info */}
-          <div className="card p-5">
-            <h3 className="text-sm font-semibold text-slate-300 mb-4">System Information</h3>
+          <div className="bg-surface border border-surface-border rounded p-5 shadow-sm">
+            <h3 className="text-sm font-semibold text-ink-muted mb-4">System Information</h3>
            <InfoRow label="Operating System" value={agent.os || '—'} />
            <InfoRow label="Architecture" value={agent.architecture || '—'} />
            <InfoRow label="IP Address" value={<span className="font-mono text-xs">{agent.ip_address || '—'}</span>} />
            <InfoRow label="Agent Version" value={agent.version || '—'} />
            {agent.capabilities?.length ? (
              <div className="mt-4">
-                <p className="text-xs text-slate-400 mb-2">Capabilities</p>
+                <p className="text-xs text-ink-muted mb-2">Capabilities</p>
                <div className="flex flex-wrap gap-2">
                  {agent.capabilities.map((c) => (
                    <span key={c} className="badge badge-info">{c}</span>
@@ -112,7 +112,7 @@ export default function AgentDetailPage() {
            ) : null}
            {agent.tags && Object.keys(agent.tags).length > 0 ? (
              <div className="mt-4">
-                <p className="text-xs text-slate-400 mb-2">Tags</p>
+                <p className="text-xs text-ink-muted mb-2">Tags</p>
                <div className="flex flex-wrap gap-2">
                  {Object.entries(agent.tags).map(([k, v]) => (
                    <span key={k} className="badge badge-neutral">{k}: {v}</span>
@@ -124,20 +124,20 @@ export default function AgentDetailPage() {
        </div>

        {/* Recent Jobs */}
-        <div className="card p-5">
-          <h3 className="text-sm font-semibold text-slate-300 mb-4">Recent Jobs</h3>
+        <div className="bg-surface border border-surface-border rounded p-5 shadow-sm">
+          <h3 className="text-sm font-semibold text-ink-muted mb-4">Recent Jobs</h3>
          {!agentJobs.length ? (
-            <p className="text-sm text-slate-500">No recent jobs</p>
+            <p className="text-sm text-ink-faint">No recent jobs</p>
          ) : (
            <div className="space-y-2">
              {agentJobs.map(j => (
-                <div key={j.id} className="flex items-center justify-between py-2 px-3 rounded-lg hover:bg-slate-700/50 transition-colors">
+                <div key={j.id} className="flex items-center justify-between py-2 px-3 rounded hover:bg-surface-muted transition-colors">
                  <div>
-                    <div className="text-sm text-slate-200">{j.type}</div>
-                    <div className="text-xs text-slate-500 font-mono">{j.id}</div>
+                    <div className="text-sm text-ink">{j.type}</div>
+                    <div className="text-xs text-ink-faint font-mono">{j.id}</div>
                  </div>
                  <div className="flex items-center gap-3">
-                    <span className="text-xs text-slate-400 font-mono">{j.certificate_id}</span>
+                    <span className="text-xs text-ink-muted font-mono">{j.certificate_id}</span>
                    <StatusBadge status={j.status} />
                  </div>
                </div>
@@ -147,16 +147,16 @@ export default function AgentDetailPage() {
        </div>

        {/* Heartbeat Timeline */}
-        <div className="card p-5">
-          <h3 className="text-sm font-semibold text-slate-300 mb-4">Heartbeat Status</h3>
+        <div className="bg-surface border border-surface-border rounded p-5 shadow-sm">
+          <h3 className="text-sm font-semibold text-ink-muted mb-4">Heartbeat Status</h3>
          <div className="flex items-center gap-4">
            <div className={`w-3 h-3 rounded-full ${
-              health === 'Online' ? 'bg-emerald-400 animate-pulse' :
-              health === 'Stale' ? 'bg-amber-400' : 'bg-red-400'
+              health === 'Online' ? 'bg-emerald-500 animate-pulse' :
+              health === 'Stale' ? 'bg-amber-500' : 'bg-red-500'
            }`} />
            <div>
-              <p className="text-sm text-slate-200">{health}</p>
-              <p className="text-xs text-slate-400">
+              <p className="text-sm text-ink">{health}</p>
+              <p className="text-xs text-ink-muted">
                {health === 'Online' && 'Agent is responding to heartbeat checks'}
                {health === 'Stale' && 'Agent has not sent a heartbeat recently'}
                {health === 'Offline' && 'Agent is not responding'}
@@ -8,7 +8,7 @@ import type { Agent } from '../api/types';

 const OS_COLORS: Record<string, string> = {
  linux: '#f97316',
-  darwin: '#3b82f6',
+  darwin: '#2ea88f',
  windows: '#8b5cf6',
  unknown: '#64748b',
 };
@@ -53,9 +53,9 @@ function groupAgents(agents: Agent[]): GroupedAgents[] {
 const CustomTooltip = ({ active, payload }: any) => {
  if (!active || !payload?.length) return null;
  return (
-    <div className="bg-slate-800 border border-slate-600 rounded-lg px-3 py-2 text-xs shadow-lg">
+    <div className="bg-surface border border-surface-border rounded px-3 py-2 text-xs shadow-lg">
      {payload.map((entry: any, i: number) => (
-        <p key={i} style={{ color: entry.payload?.fill || entry.color }}>
+        <p key={i} style={{ color: entry.payload?.fill || entry.color }} className="font-medium">
          {entry.name}: {entry.value}
        </p>
      ))}
@@ -113,25 +113,25 @@ export default function AgentFleetPage() {
      <div className="flex-1 overflow-y-auto p-6 space-y-6">
        {/* Summary Cards */}
        <div className="grid grid-cols-1 sm:grid-cols-3 gap-4">
-          <div className="card p-5 text-center">
-            <p className="text-xs font-semibold text-slate-400 uppercase tracking-wider">Total Agents</p>
-            <p className="text-3xl font-bold mt-2 text-blue-400">{totalAgents}</p>
+          <div className="bg-surface border border-surface-border border-t-4 border-t-brand-400 rounded p-5 text-center shadow-sm">
+            <p className="text-xs font-semibold text-ink-muted uppercase tracking-wider">Total Agents</p>
+            <p className="text-3xl font-bold mt-2 text-brand-500">{totalAgents}</p>
          </div>
-          <div className="card p-5 text-center">
-            <p className="text-xs font-semibold text-slate-400 uppercase tracking-wider">Online</p>
-            <p className="text-3xl font-bold mt-2 text-emerald-400">{onlineAgents}</p>
+          <div className="bg-surface border border-surface-border border-t-4 border-t-emerald-500 rounded p-5 text-center shadow-sm">
+            <p className="text-xs font-semibold text-ink-muted uppercase tracking-wider">Online</p>
+            <p className="text-3xl font-bold mt-2 text-emerald-600">{onlineAgents}</p>
          </div>
-          <div className="card p-5 text-center">
-            <p className="text-xs font-semibold text-slate-400 uppercase tracking-wider">Offline</p>
-            <p className="text-3xl font-bold mt-2 text-red-400">{offlineAgents}</p>
+          <div className="bg-surface border border-surface-border border-t-4 border-t-red-500 rounded p-5 text-center shadow-sm">
+            <p className="text-xs font-semibold text-ink-muted uppercase tracking-wider">Offline</p>
+            <p className="text-3xl font-bold mt-2 text-red-600">{offlineAgents}</p>
          </div>
        </div>

        {/* Charts */}
        <div className="grid grid-cols-1 lg:grid-cols-3 gap-6">
          {/* OS Distribution */}
-          <div className="card p-5">
-            <h3 className="text-sm font-semibold text-slate-300 mb-4">OS Distribution</h3>
+          <div className="bg-surface border border-surface-border rounded p-5 shadow-sm">
+            <h3 className="text-sm font-semibold text-ink-muted mb-4">OS Distribution</h3>
            <div className="h-48">
              {osPieData.length > 0 ? (
                <ResponsiveContainer width="100%" height="100%">
@@ -145,14 +145,14 @@ export default function AgentFleetPage() {
                  </PieChart>
                </ResponsiveContainer>
              ) : (
-                <div className="h-full flex items-center justify-center text-sm text-slate-500">No data</div>
+                <div className="h-full flex items-center justify-center text-sm text-ink-faint">No data</div>
              )}
            </div>
          </div>

          {/* Status Distribution */}
-          <div className="card p-5">
-            <h3 className="text-sm font-semibold text-slate-300 mb-4">Status Distribution</h3>
+          <div className="bg-surface border border-surface-border rounded p-5 shadow-sm">
+            <h3 className="text-sm font-semibold text-ink-muted mb-4">Status Distribution</h3>
            <div className="h-48">
              {statusPieData.length > 0 ? (
                <ResponsiveContainer width="100%" height="100%">
@@ -166,33 +166,33 @@ export default function AgentFleetPage() {
                  </PieChart>
                </ResponsiveContainer>
              ) : (
-                <div className="h-full flex items-center justify-center text-sm text-slate-500">No data</div>
+                <div className="h-full flex items-center justify-center text-sm text-ink-faint">No data</div>
              )}
            </div>
          </div>

          {/* Version Breakdown */}
-          <div className="card p-5">
-            <h3 className="text-sm font-semibold text-slate-300 mb-4">Agent Versions</h3>
+          <div className="bg-surface border border-surface-border rounded p-5 shadow-sm">
+            <h3 className="text-sm font-semibold text-ink-muted mb-4">Agent Versions</h3>
            <div className="space-y-3">
              {Object.entries(versionCounts)
                .sort(([, a], [, b]) => b - a)
                .map(([version, count]) => (
                  <div key={version} className="flex items-center justify-between">
-                    <span className="text-sm text-slate-300 font-mono">{version}</span>
+                    <span className="text-sm text-ink font-mono">{version}</span>
                    <div className="flex items-center gap-2">
-                      <div className="w-24 bg-slate-700 rounded-full h-2">
+                      <div className="w-24 bg-surface-border rounded-full h-2">
                        <div
-                          className="bg-blue-500 h-2 rounded-full"
+                          className="bg-brand-400 h-2 rounded-full"
                          style={{ width: `${(count / totalAgents) * 100}%` }}
                        />
                      </div>
-                      <span className="text-xs text-slate-400 w-8 text-right">{count}</span>
+                      <span className="text-xs text-ink-muted w-8 text-right">{count}</span>
                    </div>
                  </div>
                ))}
              {Object.keys(versionCounts).length === 0 && (
-                <p className="text-sm text-slate-500">No version data</p>
+                <p className="text-sm text-ink-faint">No version data</p>
              )}
            </div>
          </div>
@@ -200,50 +200,50 @@ export default function AgentFleetPage() {

        {/* Environment Groups */}
        <div>
-          <h3 className="text-sm font-semibold text-slate-300 mb-4">Fleet by Platform</h3>
+          <h3 className="text-sm font-semibold text-ink-muted mb-4">Fleet by Platform</h3>
          {isLoading ? (
-            <p className="text-sm text-slate-500">Loading fleet data...</p>
+            <p className="text-sm text-ink-faint">Loading fleet data...</p>
          ) : groups.length === 0 ? (
-            <p className="text-sm text-slate-500">No agents registered</p>
+            <p className="text-sm text-ink-faint">No agents registered</p>
          ) : (
            <div className="space-y-4">
              {groups.map(group => (
-                <div key={`${group.os}/${group.arch}`} className="card">
-                  <div className="px-5 py-4 border-b border-slate-700 flex items-center justify-between">
+                <div key={`${group.os}/${group.arch}`} className="bg-surface border border-surface-border rounded overflow-hidden shadow-sm">
+                  <div className="px-5 py-4 border-b border-surface-border flex items-center justify-between">
                    <div className="flex items-center gap-3">
                      <div
                        className="w-3 h-3 rounded-full"
                        style={{ backgroundColor: OS_COLORS[group.os.toLowerCase()] || '#64748b' }}
                      />
-                      <h4 className="text-sm font-medium text-slate-200">
+                      <h4 className="text-sm font-medium text-ink">
                        {group.os} / {group.arch}
                      </h4>
-                      <span className="text-xs text-slate-500">
+                      <span className="text-xs text-ink-faint">
                        {group.agents.length} agent{group.agents.length !== 1 ? 's' : ''}
                      </span>
                    </div>
                    <div className="flex items-center gap-3 text-xs">
-                      <span className="text-emerald-400">{group.online} online</span>
-                      {group.offline > 0 && <span className="text-red-400">{group.offline} offline</span>}
+                      <span className="text-emerald-600">{group.online} online</span>
+                      {group.offline > 0 && <span className="text-red-600">{group.offline} offline</span>}
                    </div>
                  </div>
-                  <div className="divide-y divide-slate-700/50">
+                  <div className="divide-y divide-surface-border/50">
                    {group.agents.map(agent => (
                      <div
                        key={agent.id}
                        onClick={() => navigate(`/agents/${agent.id}`)}
-                        className="px-5 py-3 flex items-center justify-between hover:bg-slate-700/30 cursor-pointer transition-colors"
+                        className="px-5 py-3 flex items-center justify-between hover:bg-surface-muted cursor-pointer transition-colors"
                      >
                        <div className="flex items-center gap-3">
-                          <div className={`w-2 h-2 rounded-full ${agent.status === 'Online' ? 'bg-emerald-400' : 'bg-red-400'}`} />
+                          <div className={`w-2 h-2 rounded-full ${agent.status === 'Online' ? 'bg-emerald-500' : 'bg-red-500'}`} />
                          <div>
-                            <div className="text-sm text-slate-200">{agent.name || agent.hostname}</div>
-                            <div className="text-xs text-slate-500">{agent.ip_address || agent.id}</div>
+                            <div className="text-sm text-ink">{agent.name || agent.hostname}</div>
+                            <div className="text-xs text-ink-faint">{agent.ip_address || agent.id}</div>
                          </div>
                        </div>
                        <div className="flex items-center gap-4">
                          {agent.version && (
-                            <span className="text-xs text-slate-500 font-mono">{agent.version}</span>
+                            <span className="text-xs text-ink-muted font-mono">{agent.version}</span>
                          )}
                          <StatusBadge status={agent.status} />
                        </div>
@@ -27,10 +27,10 @@ export default function AgentGroupsPage() {
      label: 'Group',
      render: (g) => (
        <div>
-          <div className="font-medium text-slate-200">{g.name}</div>
-          <div className="text-xs text-slate-500 font-mono">{g.id}</div>
+          <div className="font-medium text-ink">{g.name}</div>
+          <div className="text-xs text-ink-faint font-mono">{g.id}</div>
          {g.description && (
-            <div className="text-xs text-slate-400 mt-0.5 max-w-xs truncate">{g.description}</div>
+            <div className="text-xs text-ink-muted mt-0.5 max-w-xs truncate">{g.description}</div>
          )}
        </div>
      ),
@@ -51,7 +51,7 @@ export default function AgentGroupsPage() {
            ))}
          </div>
        ) : (
-          <span className="text-slate-500 text-xs">Manual only</span>
+          <span className="text-ink-faint text-xs">Manual only</span>
        );
      },
    },
@@ -63,7 +63,7 @@ export default function AgentGroupsPage() {
    {
      key: 'created',
      label: 'Created',
-      render: (g) => <span className="text-xs text-slate-400">{formatDateTime(g.created_at)}</span>,
+      render: (g) => <span className="text-xs text-ink-muted">{formatDateTime(g.created_at)}</span>,
    },
    {
      key: 'actions',
@@ -71,7 +71,7 @@ export default function AgentGroupsPage() {
      render: (g) => (
        <button
          onClick={(e) => { e.stopPropagation(); if (confirm(`Delete group ${g.name}?`)) deleteMutation.mutate(g.id); }}
-          className="text-xs text-red-400 hover:text-red-300 transition-colors"
+          className="text-xs text-red-600 hover:text-red-700 transition-colors"
        >
          Delete
        </button>
@@ -31,8 +31,8 @@ export default function AgentsPage() {
      label: 'Agent',
      render: (a) => (
        <div>
-          <div className="font-medium text-slate-200">{a.name}</div>
-          <div className="text-xs text-slate-500">{a.id}</div>
+          <div className="font-medium text-ink">{a.name}</div>
+          <div className="text-xs text-ink-faint">{a.id}</div>
        </div>
      ),
    },
@@ -41,14 +41,14 @@ export default function AgentsPage() {
      label: 'Health',
      render: (a) => <StatusBadge status={a.status || heartbeatStatus(a.last_heartbeat)} />,
    },
-    { key: 'hostname', label: 'Hostname', render: (a) => <span className="text-slate-300 font-mono text-xs">{a.hostname || '—'}</span> },
-    { key: 'os', label: 'OS / Arch', render: (a) => <span className="text-slate-400 text-xs">{a.os && a.architecture ? `${a.os}/${a.architecture}` : a.os || '—'}</span> },
-    { key: 'ip', label: 'IP Address', render: (a) => <span className="text-slate-400 font-mono text-xs">{a.ip_address || '—'}</span> },
-    { key: 'version', label: 'Version', render: (a) => <span className="text-slate-400 text-xs">{a.version || '—'}</span> },
+    { key: 'hostname', label: 'Hostname', render: (a) => <span className="text-ink-muted font-mono text-xs">{a.hostname || '—'}</span> },
+    { key: 'os', label: 'OS / Arch', render: (a) => <span className="text-ink-muted text-xs">{a.os && a.architecture ? `${a.os}/${a.architecture}` : a.os || '—'}</span> },
+    { key: 'ip', label: 'IP Address', render: (a) => <span className="text-ink-muted font-mono text-xs">{a.ip_address || '—'}</span> },
+    { key: 'version', label: 'Version', render: (a) => <span className="text-ink-muted text-xs">{a.version || '—'}</span> },
    {
      key: 'heartbeat',
      label: 'Last Heartbeat',
-      render: (a) => <span className="text-slate-400 text-xs">{timeAgo(a.last_heartbeat)}</span>,
+      render: (a) => <span className="text-ink-muted text-xs">{timeAgo(a.last_heartbeat)}</span>,
    },
  ];

@@ -9,16 +9,16 @@ import { formatDateTime } from '../api/utils';
 import type { AuditEvent } from '../api/types';

 const actionColors: Record<string, string> = {
-  certificate_created: 'text-emerald-400',
-  renewal_triggered: 'text-blue-400',
-  renewal_job_created: 'text-blue-400',
-  renewal_completed: 'text-emerald-400',
-  deployment_completed: 'text-emerald-400',
-  deployment_failed: 'text-red-400',
-  expiration_alert_sent: 'text-amber-400',
-  agent_registered: 'text-blue-400',
-  policy_violated: 'text-red-400',
-  certificate_revoked: 'text-red-400',
+  certificate_created: 'text-emerald-600',
+  renewal_triggered: 'text-brand-500',
+  renewal_job_created: 'text-brand-500',
+  renewal_completed: 'text-emerald-600',
+  deployment_completed: 'text-emerald-600',
+  deployment_failed: 'text-red-600',
+  expiration_alert_sent: 'text-amber-600',
+  agent_registered: 'text-brand-500',
+  policy_violated: 'text-red-600',
+  certificate_revoked: 'text-red-600',
 };

 const RESOURCE_TYPES = ['', 'certificate', 'agent', 'job', 'notification', 'policy', 'target', 'issuer'];
@@ -94,7 +94,7 @@ export default function AuditPage() {
      key: 'action',
      label: 'Action',
      render: (e) => (
-        <span className={`text-sm font-medium ${actionColors[e.action] || 'text-slate-300'}`}>
+        <span className={`text-sm font-medium ${actionColors[e.action] || 'text-ink'}`}>
          {e.action.replace(/_/g, ' ')}
        </span>
      ),
@@ -104,8 +104,8 @@ export default function AuditPage() {
      label: 'Actor',
      render: (e) => (
        <div>
-          <div className="text-sm text-slate-200">{e.actor}</div>
-          <div className="text-xs text-slate-500">{e.actor_type}</div>
+          <div className="text-sm text-ink">{e.actor}</div>
+          <div className="text-xs text-ink-faint">{e.actor_type}</div>
        </div>
      ),
    },
@@ -114,8 +114,8 @@ export default function AuditPage() {
      label: 'Resource',
      render: (e) => (
        <div>
-          <div className="text-sm text-slate-300">{e.resource_type}</div>
-          <div className="text-xs text-slate-500 font-mono">{e.resource_id}</div>
+          <div className="text-sm text-ink">{e.resource_type}</div>
+          <div className="text-xs text-ink-faint font-mono">{e.resource_id}</div>
        </div>
      ),
    },
@@ -123,15 +123,15 @@ export default function AuditPage() {
      key: 'details',
      label: 'Details',
      render: (e) => {
-        if (!e.details || Object.keys(e.details).length === 0) return <span className="text-slate-500">&mdash;</span>;
+        if (!e.details || Object.keys(e.details).length === 0) return <span className="text-ink-faint">&mdash;</span>;
        return (
-          <span className="text-xs text-slate-400 font-mono truncate max-w-xs block">
+          <span className="text-xs text-ink-muted font-mono truncate max-w-xs block">
            {JSON.stringify(e.details).slice(0, 60)}
          </span>
        );
      },
    },
-    { key: 'time', label: 'Time', render: (e) => <span className="text-xs text-slate-400">{formatDateTime(e.timestamp)}</span> },
+    { key: 'time', label: 'Time', render: (e) => <span className="text-xs text-ink-muted">{formatDateTime(e.timestamp)}</span> },
  ];

  const hasFilters = resourceType || actorFilter || timeRange || actionFilter;
@@ -144,21 +144,21 @@ export default function AuditPage() {
        action={
          filtered.length > 0 ? (
            <div className="flex gap-2">
-              <button onClick={() => exportCSV(filtered)} className="btn btn-ghost text-xs border border-slate-600">
+              <button onClick={() => exportCSV(filtered)} className="btn btn-ghost text-xs border border-surface-border">
                Export CSV
              </button>
-              <button onClick={() => exportJSON(filtered)} className="btn btn-ghost text-xs border border-slate-600">
+              <button onClick={() => exportJSON(filtered)} className="btn btn-ghost text-xs border border-surface-border">
                Export JSON
              </button>
            </div>
          ) : undefined
        }
      />
-      <div className="px-4 py-3 flex flex-wrap gap-3 border-b border-slate-700/50">
+      <div className="px-4 py-3 flex flex-wrap gap-3 border-b border-surface-border/50">
        <select
          value={resourceType}
          onChange={(e) => setResourceType(e.target.value)}
-          className="bg-slate-800 border border-slate-600 rounded px-3 py-1.5 text-xs text-slate-300 focus:outline-none focus:border-blue-500"
+          className="bg-surface border border-surface-border rounded px-3 py-1.5 text-xs text-ink focus:outline-none focus:border-brand-400"
        >
          <option value="">All resources</option>
          {RESOURCE_TYPES.filter(Boolean).map((t) => (
@@ -170,19 +170,19 @@ export default function AuditPage() {
          placeholder="Filter by actor..."
          value={actorFilter}
          onChange={(e) => setActorFilter(e.target.value)}
-          className="bg-slate-800 border border-slate-600 rounded px-3 py-1.5 text-xs text-slate-300 placeholder-slate-500 focus:outline-none focus:border-blue-500 w-40"
+          className="bg-surface border border-surface-border rounded px-3 py-1.5 text-xs text-ink placeholder-ink-faint focus:outline-none focus:border-brand-400 w-40"
        />
        <input
          type="text"
          placeholder="Filter by action..."
          value={actionFilter}
          onChange={(e) => setActionFilter(e.target.value)}
-          className="bg-slate-800 border border-slate-600 rounded px-3 py-1.5 text-xs text-slate-300 placeholder-slate-500 focus:outline-none focus:border-blue-500 w-40"
+          className="bg-surface border border-surface-border rounded px-3 py-1.5 text-xs text-ink placeholder-ink-faint focus:outline-none focus:border-brand-400 w-40"
        />
        <select
          value={timeRange}
          onChange={(e) => setTimeRange(e.target.value)}
-          className="bg-slate-800 border border-slate-600 rounded px-3 py-1.5 text-xs text-slate-300 focus:outline-none focus:border-blue-500"
+          className="bg-surface border border-surface-border rounded px-3 py-1.5 text-xs text-ink focus:outline-none focus:border-brand-400"
        >
          {TIME_RANGES.map((r) => (
            <option key={r.value} value={r.value}>{r.label}</option>
@@ -191,7 +191,7 @@ export default function AuditPage() {
        {hasFilters && (
          <button
            onClick={() => { setResourceType(''); setActorFilter(''); setTimeRange(''); setActionFilter(''); }}
-            className="text-xs text-slate-400 hover:text-slate-200 transition-colors"
+            className="text-xs text-ink-muted hover:text-ink transition-colors"
          >
            Clear filters
          </button>
@@ -11,12 +11,12 @@ import type { Job } from '../api/types';

 function InfoRow({ label, value, editable, onEdit }: { label: string; value: React.ReactNode; editable?: boolean; onEdit?: () => void }) {
  return (
-    <div className="flex justify-between py-2 border-b border-slate-700/50 group">
-      <span className="text-sm text-slate-400">{label}</span>
+    <div className="flex justify-between py-2 border-b border-surface-border/50 group">
+      <span className="text-sm text-ink-muted">{label}</span>
      <div className="flex items-center gap-2">
-        <span className="text-sm text-slate-200">{value}</span>
+        <span className="text-sm text-ink">{value}</span>
        {editable && onEdit && (
-          <button onClick={onEdit} className="opacity-0 group-hover:opacity-100 transition-opacity text-xs text-blue-400 hover:text-blue-300">
+          <button onClick={onEdit} className="opacity-0 group-hover:opacity-100 transition-opacity text-xs text-brand-400 hover:text-brand-500">
            Edit
          </button>
        )}
@@ -28,22 +28,22 @@ function InfoRow({ label, value, editable, onEdit }: { label: string; value: Rea
 // Timeline step component for deployment status
 function TimelineStep({ label, status, time, isLast }: { label: string; status: 'completed' | 'active' | 'pending' | 'failed'; time?: string; isLast?: boolean }) {
  const dotStyles = {
-    completed: 'bg-emerald-500 ring-emerald-500/30',
-    active: 'bg-blue-500 ring-blue-500/30 animate-pulse',
-    pending: 'bg-slate-600 ring-slate-600/30',
-    failed: 'bg-red-500 ring-red-500/30',
+    completed: 'bg-emerald-500 ring-emerald-200',
+    active: 'bg-brand-400 ring-brand-200 animate-pulse',
+    pending: 'bg-surface-muted ring-surface-border',
+    failed: 'bg-red-500 ring-red-200',
  };
  const lineStyles = {
-    completed: 'bg-emerald-500/50',
-    active: 'bg-blue-500/30',
-    pending: 'bg-slate-700',
-    failed: 'bg-red-500/30',
+    completed: 'bg-emerald-300',
+    active: 'bg-brand-200',
+    pending: 'bg-surface-border',
+    failed: 'bg-red-300',
  };
  const textStyles = {
-    completed: 'text-emerald-400',
-    active: 'text-blue-400',
-    pending: 'text-slate-500',
-    failed: 'text-red-400',
+    completed: 'text-emerald-600',
+    active: 'text-brand-400',
+    pending: 'text-ink-faint',
+    failed: 'text-red-600',
  };

  return (
@@ -54,7 +54,7 @@ function TimelineStep({ label, status, time, isLast }: { label: string; status:
      </div>
      <div className="pb-6">
        <div className={`text-sm font-medium ${textStyles[status]}`}>{label}</div>
-        {time && <div className="text-xs text-slate-500 mt-0.5">{time}</div>}
+        {time && <div className="text-xs text-ink-faint mt-0.5">{time}</div>}
      </div>
    </div>
  );
@@ -117,8 +117,8 @@ function DeploymentTimeline({ certId, certStatus, createdAt, issuedAt }: { certI
  };

  return (
-    <div className="card p-5">
-      <h3 className="text-sm font-semibold text-slate-300 mb-4">Lifecycle Timeline</h3>
+    <div className="bg-surface border border-surface-border rounded p-5 shadow-sm">
+      <h3 className="text-sm font-semibold text-ink-muted mb-4">Lifecycle Timeline</h3>
      <div className="pl-1">
        <TimelineStep label="Requested" status={getRequestedStatus()} time={getRequestedTime()} />
        <TimelineStep label="Issued" status={getIssuedStatus()} time={getIssuedTime()} />
@@ -161,10 +161,10 @@ function InlinePolicyEditor({ certId, currentPolicyId, currentProfileId }: { cer

  if (!editing) {
    return (
-      <div className="card p-5">
+      <div className="bg-surface border border-surface-border rounded p-5 shadow-sm">
        <div className="flex items-center justify-between mb-4">
-          <h3 className="text-sm font-semibold text-slate-300">Policy & Profile</h3>
-          <button onClick={() => setEditing(true)} className="text-xs text-blue-400 hover:text-blue-300 transition-colors">
+          <h3 className="text-sm font-semibold text-ink-muted">Policy & Profile</h3>
+          <button onClick={() => setEditing(true)} className="text-xs text-brand-400 hover:text-brand-500 transition-colors">
            Edit
          </button>
        </div>
@@ -175,28 +175,28 @@ function InlinePolicyEditor({ certId, currentPolicyId, currentProfileId }: { cer
  }

  return (
-    <div className="card p-5 border-blue-500/30">
+    <div className="bg-surface border border-surface-border border-brand-400 rounded p-5 shadow-sm">
      <div className="flex items-center justify-between mb-4">
-        <h3 className="text-sm font-semibold text-blue-400">Edit Policy & Profile</h3>
+        <h3 className="text-sm font-semibold text-brand-500">Edit Policy & Profile</h3>
        <div className="flex gap-2">
          <button onClick={() => { setEditing(false); setPolicyId(currentPolicyId); setProfileId(currentProfileId); }}
-            className="text-xs text-slate-400 hover:text-slate-300">Cancel</button>
+            className="text-xs text-ink-muted hover:text-ink">Cancel</button>
          <button onClick={() => saveMutation.mutate()} disabled={saveMutation.isPending}
-            className="text-xs text-blue-400 hover:text-blue-300 font-medium disabled:opacity-50">
+            className="text-xs text-brand-400 hover:text-brand-500 font-medium disabled:opacity-50">
            {saveMutation.isPending ? 'Saving...' : 'Save'}
          </button>
        </div>
      </div>
      {saveMutation.isError && (
-        <div className="bg-red-500/10 border border-red-500/20 text-red-400 rounded-lg px-3 py-2 text-sm mb-3">
+        <div className="bg-red-50 border border-red-200 text-red-700 rounded px-3 py-2 text-sm mb-3">
          {saveMutation.error instanceof Error ? saveMutation.error.message : 'Failed to save'}
        </div>
      )}
      <div className="space-y-3">
        <div>
-          <label className="text-xs text-slate-400 block mb-1">Renewal Policy</label>
+          <label className="text-xs text-ink-muted block mb-1">Renewal Policy</label>
          <select value={policyId} onChange={e => setPolicyId(e.target.value)}
-            className="w-full bg-slate-900 border border-slate-600 rounded-lg px-3 py-2 text-sm text-slate-200">
+            className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink">
            <option value="">None</option>
            {policies?.data?.map(p => (
              <option key={p.id} value={p.id}>{p.name} ({p.type})</option>
@@ -204,9 +204,9 @@ function InlinePolicyEditor({ certId, currentPolicyId, currentProfileId }: { cer
          </select>
        </div>
        <div>
-          <label className="text-xs text-slate-400 block mb-1">Certificate Profile</label>
+          <label className="text-xs text-ink-muted block mb-1">Certificate Profile</label>
          <select value={profileId} onChange={e => setProfileId(e.target.value)}
-            className="w-full bg-slate-900 border border-slate-600 rounded-lg px-3 py-2 text-sm text-slate-200">
+            className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink">
            <option value="">None</option>
            {profiles?.data?.map(p => (
              <option key={p.id} value={p.id}>{p.name} — max TTL {p.max_ttl_seconds ? `${Math.round(p.max_ttl_seconds / 86400)}d` : '∞'}</option>
@@ -316,7 +316,7 @@ export default function CertificateDetailPage() {
            <button
              onClick={() => setShowDeploy(true)}
              disabled={isArchived || isRevoked}
-              className="btn btn-ghost text-xs border border-slate-600 disabled:opacity-50"
+              className="btn btn-ghost text-xs border border-surface-border disabled:opacity-50"
            >
              Deploy
            </button>
@@ -349,53 +349,53 @@ export default function CertificateDetailPage() {
      />
      <div className="flex-1 overflow-y-auto p-6 space-y-6">
        {renewMutation.isSuccess && (
-          <div className="bg-emerald-500/10 border border-emerald-500/20 text-emerald-400 rounded-lg px-4 py-3 text-sm">
+          <div className="bg-emerald-50 border border-emerald-200 text-emerald-700 rounded px-4 py-3 text-sm">
            Renewal triggered successfully. A renewal job has been created.
          </div>
        )}
        {renewMutation.isError && (
-          <div className="bg-red-500/10 border border-red-500/20 text-red-400 rounded-lg px-4 py-3 text-sm">
+          <div className="bg-red-50 border border-red-200 text-red-700 rounded px-4 py-3 text-sm">
            Failed to trigger renewal: {renewMutation.error instanceof Error ? renewMutation.error.message : 'Unknown error'}
          </div>
        )}
        {deployMutation.isSuccess && (
-          <div className="bg-emerald-500/10 border border-emerald-500/20 text-emerald-400 rounded-lg px-4 py-3 text-sm">
+          <div className="bg-emerald-50 border border-emerald-200 text-emerald-700 rounded px-4 py-3 text-sm">
            Deployment triggered. A deployment job has been created.
          </div>
        )}
        {deployMutation.isError && (
-          <div className="bg-red-500/10 border border-red-500/20 text-red-400 rounded-lg px-4 py-3 text-sm">
+          <div className="bg-red-50 border border-red-200 text-red-700 rounded px-4 py-3 text-sm">
            Failed to deploy: {deployMutation.error instanceof Error ? deployMutation.error.message : 'Unknown error'}
          </div>
        )}
        {archiveMutation.isError && (
-          <div className="bg-red-500/10 border border-red-500/20 text-red-400 rounded-lg px-4 py-3 text-sm">
+          <div className="bg-red-50 border border-red-200 text-red-700 rounded px-4 py-3 text-sm">
            Failed to archive: {archiveMutation.error instanceof Error ? archiveMutation.error.message : 'Unknown error'}
          </div>
        )}
        {revokeMutation.isSuccess && (
-          <div className="bg-amber-500/10 border border-amber-500/20 text-amber-400 rounded-lg px-4 py-3 text-sm">
+          <div className="bg-amber-50 border border-amber-200 text-amber-700 rounded px-4 py-3 text-sm">
            Certificate revoked successfully. It has been added to the CRL.
          </div>
        )}
        {revokeMutation.isError && (
-          <div className="bg-red-500/10 border border-red-500/20 text-red-400 rounded-lg px-4 py-3 text-sm">
+          <div className="bg-red-50 border border-red-200 text-red-700 rounded px-4 py-3 text-sm">
            Failed to revoke: {revokeMutation.error instanceof Error ? revokeMutation.error.message : 'Unknown error'}
          </div>
        )}

        {/* Revocation Banner */}
        {isRevoked && (
-          <div className="bg-red-500/10 border border-red-500/30 rounded-lg px-4 py-3">
+          <div className="bg-red-50 border border-red-200 rounded px-4 py-3">
            <div className="flex items-center gap-3">
-              <div className="w-8 h-8 rounded-full bg-red-500/20 flex items-center justify-center flex-shrink-0">
-                <svg className="w-4 h-4 text-red-400" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+              <div className="w-8 h-8 rounded bg-red-100 flex items-center justify-center flex-shrink-0">
+                <svg className="w-4 h-4 text-red-600" fill="none" viewBox="0 0 24 24" stroke="currentColor">
                  <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M18.364 18.364A9 9 0 005.636 5.636m12.728 12.728A9 9 0 015.636 5.636m12.728 12.728L5.636 5.636" />
                </svg>
              </div>
              <div>
-                <div className="text-sm font-medium text-red-400">Certificate Revoked</div>
-                <div className="text-xs text-slate-400 mt-0.5">
+                <div className="text-sm font-medium text-red-700">Certificate Revoked</div>
+                <div className="text-xs text-red-600 mt-0.5">
                  Reason: {REVOCATION_REASONS.find(r => r.value === cert.revocation_reason)?.label || cert.revocation_reason || 'Unspecified'}
                  {cert.revoked_at && <> &middot; Revoked {formatDateTime(cert.revoked_at)}</>}
                </div>
@@ -409,8 +409,8 @@ export default function CertificateDetailPage() {

        <div className="grid grid-cols-1 lg:grid-cols-2 gap-6">
          {/* Certificate Info */}
-          <div className="card p-5">
-            <h3 className="text-sm font-semibold text-slate-300 mb-4">Certificate Details</h3>
+          <div className="bg-surface border border-surface-border rounded p-5 shadow-sm">
+            <h3 className="text-sm font-semibold text-ink-muted mb-4">Certificate Details</h3>
            <InfoRow label="Status" value={<StatusBadge status={cert.status} />} />
            <InfoRow label="Common Name" value={cert.common_name} />
            <InfoRow label="SANs" value={cert.sans?.length ? cert.sans.join(', ') : '—'} />
@@ -423,11 +423,11 @@ export default function CertificateDetailPage() {
          </div>

          {/* Lifecycle */}
-          <div className="card p-5">
-            <h3 className="text-sm font-semibold text-slate-300 mb-4">Lifecycle</h3>
+          <div className="bg-surface border border-surface-border rounded p-5 shadow-sm">
+            <h3 className="text-sm font-semibold text-ink-muted mb-4">Lifecycle</h3>
            <InfoRow label="Issued" value={formatDate(cert.issued_at)} />
            <InfoRow label="Expires" value={
-              <span className={isRevoked ? 'text-red-400 line-through' : expiryColor(days)}>
+              <span className={isRevoked ? 'text-red-600 line-through' : expiryColor(days)}>
                {formatDate(cert.expires_at)} ({days <= 0 ? 'expired' : `${days} days`})
              </span>
            } />
@@ -438,10 +438,10 @@ export default function CertificateDetailPage() {
            {isRevoked && (
              <>
                <InfoRow label="Revoked At" value={
-                  <span className="text-red-400">{cert.revoked_at ? formatDateTime(cert.revoked_at) : '—'}</span>
+                  <span className="text-red-600">{cert.revoked_at ? formatDateTime(cert.revoked_at) : '—'}</span>
                } />
                <InfoRow label="Revocation Reason" value={
-                  <span className="text-red-400">
+                  <span className="text-red-600">
                    {REVOCATION_REASONS.find(r => r.value === cert.revocation_reason)?.label || cert.revocation_reason || '—'}
                  </span>
                } />
@@ -461,8 +461,8 @@ export default function CertificateDetailPage() {

        {/* Tags */}
        {cert.tags && Object.keys(cert.tags).length > 0 && (
-          <div className="card p-5">
-            <h3 className="text-sm font-semibold text-slate-300 mb-4">Tags</h3>
+          <div className="bg-surface border border-surface-border rounded p-5 shadow-sm">
+            <h3 className="text-sm font-semibold text-ink-muted mb-4">Tags</h3>
            <div className="flex flex-wrap gap-2">
              {Object.entries(cert.tags).map(([k, v]) => (
                <span key={k} className="badge badge-neutral">{k}: {v}</span>
@@ -472,32 +472,32 @@ export default function CertificateDetailPage() {
        )}

        {/* Version History */}
-        <div className="card p-5">
-          <h3 className="text-sm font-semibold text-slate-300 mb-4">
+        <div className="bg-surface border border-surface-border rounded p-5 shadow-sm">
+          <h3 className="text-sm font-semibold text-ink-muted mb-4">
            Version History {versions?.data?.length ? `(${versions.data.length})` : ''}
          </h3>
          {!versions?.data?.length ? (
-            <p className="text-sm text-slate-500">No versions yet</p>
+            <p className="text-sm text-ink-faint">No versions yet</p>
          ) : (
            <div className="space-y-3">
              {versions.data.map((v, idx) => (
-                <div key={v.id} className="flex items-center justify-between py-2 border-b border-slate-700/50 last:border-0">
+                <div key={v.id} className="flex items-center justify-between py-2 border-b border-surface-border/50 last:border-0">
                  <div>
                    <div className="flex items-center gap-2">
-                      <span className="text-sm text-slate-200">Version {v.version}</span>
-                      {idx === 0 && <span className="text-xs bg-blue-500/20 text-blue-400 px-1.5 py-0.5 rounded">Current</span>}
+                      <span className="text-sm text-ink">Version {v.version}</span>
+                      {idx === 0 && <span className="text-xs bg-brand-100 text-brand-700 px-1.5 py-0.5 rounded">Current</span>}
                    </div>
-                    <div className="text-xs text-slate-500 font-mono">{v.serial_number}</div>
+                    <div className="text-xs text-ink-faint font-mono">{v.serial_number}</div>
                  </div>
                  <div className="flex items-center gap-4">
                    <div className="text-right">
-                      <div className="text-sm text-slate-300">{formatDate(v.not_before)} — {formatDate(v.not_after)}</div>
-                      <div className="text-xs text-slate-500">{formatDateTime(v.created_at)}</div>
+                      <div className="text-sm text-ink-muted">{formatDate(v.not_before)} — {formatDate(v.not_after)}</div>
+                      <div className="text-xs text-ink-faint">{formatDateTime(v.created_at)}</div>
                    </div>
                    {idx > 0 && cert?.status !== 'Archived' && cert?.status !== 'Revoked' && (
                      <button
                        onClick={() => setShowDeploy(true)}
-                        className="text-xs text-amber-400 hover:text-amber-300 border border-amber-500/30 px-2 py-1 rounded hover:bg-amber-500/10 transition-colors"
+                        className="text-xs text-amber-600 hover:text-amber-700 border border-amber-300 px-2 py-1 rounded hover:bg-amber-50 transition-colors"
                        title="Redeploy this version to targets"
                      >
                        Rollback
@@ -513,19 +513,19 @@ export default function CertificateDetailPage() {

      {/* Deploy Modal */}
      {showDeploy && (
-        <div className="fixed inset-0 bg-black/60 flex items-center justify-center z-50" onClick={() => setShowDeploy(false)}>
-          <div className="bg-slate-800 border border-slate-600 rounded-xl p-6 w-full max-w-md shadow-2xl" onClick={e => e.stopPropagation()}>
-            <h2 className="text-lg font-semibold text-slate-200 mb-4">Deploy Certificate</h2>
+        <div className="fixed inset-0 bg-black/40 flex items-center justify-center z-50" onClick={() => setShowDeploy(false)}>
+          <div className="bg-surface border border-surface-border rounded p-6 w-full max-w-md shadow-xl" onClick={e => e.stopPropagation()}>
+            <h2 className="text-lg font-semibold text-ink mb-4">Deploy Certificate</h2>
            {deployMutation.isError && (
-              <div className="bg-red-500/10 border border-red-500/20 text-red-400 rounded-lg px-3 py-2 text-sm mb-3">
+              <div className="bg-red-50 border border-red-200 text-red-700 rounded px-3 py-2 text-sm mb-3">
                {deployMutation.error instanceof Error ? deployMutation.error.message : 'Unknown error'}
              </div>
            )}
-            <label className="text-xs text-slate-400 block mb-2">Select Target</label>
+            <label className="text-xs text-ink-muted block mb-2">Select Target</label>
            <select
              value={deployTargetId}
              onChange={e => setDeployTargetId(e.target.value)}
-              className="w-full bg-slate-900 border border-slate-600 rounded-lg px-3 py-2 text-sm text-slate-200 mb-4"
+              className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink mb-4"
            >
              <option value="">Choose a target...</option>
              {targets?.data?.map(t => (
@@ -548,22 +548,22 @@ export default function CertificateDetailPage() {

      {/* Revoke Modal */}
      {showRevoke && (
-        <div className="fixed inset-0 bg-black/60 flex items-center justify-center z-50" onClick={() => setShowRevoke(false)}>
-          <div className="bg-slate-800 border border-slate-600 rounded-xl p-6 w-full max-w-md shadow-2xl" onClick={e => e.stopPropagation()}>
-            <h2 className="text-lg font-semibold text-red-400 mb-2">Revoke Certificate</h2>
-            <p className="text-sm text-slate-400 mb-4">
+        <div className="fixed inset-0 bg-black/40 flex items-center justify-center z-50" onClick={() => setShowRevoke(false)}>
+          <div className="bg-surface border border-surface-border rounded p-6 w-full max-w-md shadow-xl" onClick={e => e.stopPropagation()}>
+            <h2 className="text-lg font-semibold text-red-700 mb-2">Revoke Certificate</h2>
+            <p className="text-sm text-ink-muted mb-4">
              This action cannot be undone. The certificate will be added to the CRL and marked as revoked.
            </p>
            {revokeMutation.isError && (
-              <div className="bg-red-500/10 border border-red-500/20 text-red-400 rounded-lg px-3 py-2 text-sm mb-3">
+              <div className="bg-red-50 border border-red-200 text-red-700 rounded px-3 py-2 text-sm mb-3">
                {revokeMutation.error instanceof Error ? revokeMutation.error.message : 'Unknown error'}
              </div>
            )}
-            <label className="text-xs text-slate-400 block mb-2">Revocation Reason (RFC 5280)</label>
+            <label className="text-xs text-ink-muted block mb-2">Revocation Reason (RFC 5280)</label>
            <select
              value={revokeReason}
              onChange={e => setRevokeReason(e.target.value)}
-              className="w-full bg-slate-900 border border-slate-600 rounded-lg px-3 py-2 text-sm text-slate-200 mb-4"
+              className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink mb-4"
            >
              {REVOCATION_REASONS.map(r => (
                <option key={r.value} value={r.value}>{r.label}</option>
@@ -30,57 +30,57 @@ function CreateCertificateModal({ onClose, onSuccess }: { onClose: () => void; o
  });

  return (
-    <div className="fixed inset-0 bg-black/60 flex items-center justify-center z-50" onClick={onClose}>
-      <div className="bg-slate-800 border border-slate-600 rounded-xl p-6 w-full max-w-lg shadow-2xl" onClick={e => e.stopPropagation()}>
-        <h2 className="text-lg font-semibold text-slate-200 mb-4">New Certificate</h2>
-        {error && <div className="bg-red-500/10 border border-red-500/20 text-red-400 rounded-lg px-3 py-2 text-sm mb-4">{error}</div>}
+    <div className="fixed inset-0 bg-black/40 flex items-center justify-center z-50" onClick={onClose}>
+      <div className="bg-surface border border-surface-border rounded p-6 w-full max-w-lg shadow-xl" onClick={e => e.stopPropagation()}>
+        <h2 className="text-lg font-semibold text-ink mb-4">New Certificate</h2>
+        {error && <div className="bg-red-50 border border-red-200 text-red-700 rounded px-3 py-2 text-sm mb-4">{error}</div>}
        <div className="space-y-3">
          <div>
-            <label className="text-xs text-slate-400 block mb-1">ID (optional)</label>
+            <label className="text-xs text-ink-muted block mb-1">ID (optional)</label>
            <input value={form.id} onChange={e => setForm(f => ({ ...f, id: e.target.value }))}
-              className="w-full bg-slate-900 border border-slate-600 rounded-lg px-3 py-2 text-sm text-slate-200 focus:outline-none focus:border-blue-500"
+              className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink focus:outline-none focus:border-brand-400 focus:ring-1 focus:ring-brand-400/20"
              placeholder="mc-api-prod (auto-generated if empty)" />
          </div>
          <div>
-            <label className="text-xs text-slate-400 block mb-1">Common Name *</label>
+            <label className="text-xs text-ink-muted block mb-1">Common Name *</label>
            <input value={form.common_name} onChange={e => setForm(f => ({ ...f, common_name: e.target.value }))}
-              className="w-full bg-slate-900 border border-slate-600 rounded-lg px-3 py-2 text-sm text-slate-200 focus:outline-none focus:border-blue-500"
+              className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink focus:outline-none focus:border-brand-400 focus:ring-1 focus:ring-brand-400/20"
              placeholder="api.example.com" />
          </div>
          <div className="grid grid-cols-2 gap-3">
            <div>
-              <label className="text-xs text-slate-400 block mb-1">Environment</label>
+              <label className="text-xs text-ink-muted block mb-1">Environment</label>
              <select value={form.environment} onChange={e => setForm(f => ({ ...f, environment: e.target.value }))}
-                className="w-full bg-slate-900 border border-slate-600 rounded-lg px-3 py-2 text-sm text-slate-200">
+                className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink">
                <option value="production">Production</option>
                <option value="staging">Staging</option>
                <option value="development">Development</option>
              </select>
            </div>
            <div>
-              <label className="text-xs text-slate-400 block mb-1">Issuer ID *</label>
+              <label className="text-xs text-ink-muted block mb-1">Issuer ID *</label>
              <input value={form.issuer_id} onChange={e => setForm(f => ({ ...f, issuer_id: e.target.value }))}
-                className="w-full bg-slate-900 border border-slate-600 rounded-lg px-3 py-2 text-sm text-slate-200 focus:outline-none focus:border-blue-500"
+                className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink focus:outline-none focus:border-brand-400 focus:ring-1 focus:ring-brand-400/20"
                placeholder="iss-local" />
            </div>
          </div>
          <div className="grid grid-cols-3 gap-3">
            <div>
-              <label className="text-xs text-slate-400 block mb-1">Owner ID</label>
+              <label className="text-xs text-ink-muted block mb-1">Owner ID</label>
              <input value={form.owner_id} onChange={e => setForm(f => ({ ...f, owner_id: e.target.value }))}
-                className="w-full bg-slate-900 border border-slate-600 rounded-lg px-3 py-2 text-sm text-slate-200 focus:outline-none focus:border-blue-500"
+                className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink focus:outline-none focus:border-brand-400 focus:ring-1 focus:ring-brand-400/20"
                placeholder="o-alice" />
            </div>
            <div>
-              <label className="text-xs text-slate-400 block mb-1">Team ID</label>
+              <label className="text-xs text-ink-muted block mb-1">Team ID</label>
              <input value={form.team_id} onChange={e => setForm(f => ({ ...f, team_id: e.target.value }))}
-                className="w-full bg-slate-900 border border-slate-600 rounded-lg px-3 py-2 text-sm text-slate-200 focus:outline-none focus:border-blue-500"
+                className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink focus:outline-none focus:border-brand-400 focus:ring-1 focus:ring-brand-400/20"
                placeholder="t-platform" />
            </div>
            <div>
-              <label className="text-xs text-slate-400 block mb-1">Policy ID</label>
+              <label className="text-xs text-ink-muted block mb-1">Policy ID</label>
              <input value={form.renewal_policy_id} onChange={e => setForm(f => ({ ...f, renewal_policy_id: e.target.value }))}
-                className="w-full bg-slate-900 border border-slate-600 rounded-lg px-3 py-2 text-sm text-slate-200 focus:outline-none focus:border-blue-500"
+                className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink focus:outline-none focus:border-brand-400 focus:ring-1 focus:ring-brand-400/20"
                placeholder="rp-standard" />
            </div>
          </div>
@@ -124,27 +124,27 @@ function BulkRevokeModal({ ids, onClose, onSuccess }: { ids: string[]; onClose:
  };

  return (
-    <div className="fixed inset-0 bg-black/60 flex items-center justify-center z-50" onClick={onClose}>
-      <div className="bg-slate-800 border border-slate-600 rounded-xl p-6 w-full max-w-md shadow-2xl" onClick={e => e.stopPropagation()}>
-        <h2 className="text-lg font-semibold text-red-400 mb-2">Bulk Revoke</h2>
-        <p className="text-sm text-slate-400 mb-4">
+    <div className="fixed inset-0 bg-black/40 flex items-center justify-center z-50" onClick={onClose}>
+      <div className="bg-surface border border-surface-border rounded p-6 w-full max-w-md shadow-xl" onClick={e => e.stopPropagation()}>
+        <h2 className="text-lg font-semibold text-red-700 mb-2">Bulk Revoke</h2>
+        <p className="text-sm text-ink-muted mb-4">
          Revoke {ids.length} certificate{ids.length > 1 ? 's' : ''}. This cannot be undone.
        </p>
-        {error && <div className="bg-red-500/10 border border-red-500/20 text-red-400 rounded-lg px-3 py-2 text-sm mb-3">{error}</div>}
+        {error && <div className="bg-red-50 border border-red-200 text-red-700 rounded px-3 py-2 text-sm mb-3">{error}</div>}
        {running && (
          <div className="mb-3">
-            <div className="flex justify-between text-xs text-slate-400 mb-1">
+            <div className="flex justify-between text-xs text-ink-muted mb-1">
              <span>Progress</span>
              <span>{progress}/{ids.length}</span>
            </div>
-            <div className="w-full bg-slate-700 rounded-full h-2">
+            <div className="w-full bg-surface-border rounded-full h-2">
              <div className="bg-red-500 h-2 rounded-full transition-all" style={{ width: `${(progress / ids.length) * 100}%` }} />
            </div>
          </div>
        )}
-        <label className="text-xs text-slate-400 block mb-2">Revocation Reason (RFC 5280)</label>
+        <label className="text-xs text-ink-muted block mb-2">Revocation Reason (RFC 5280)</label>
        <select value={reason} onChange={e => setReason(e.target.value)}
-          className="w-full bg-slate-900 border border-slate-600 rounded-lg px-3 py-2 text-sm text-slate-200 mb-4"
+          className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink mb-4"
          disabled={running}
        >
          {REVOCATION_REASONS.map(r => (
@@ -193,27 +193,27 @@ function BulkReassignModal({ ids, onClose, onSuccess }: { ids: string[]; onClose
  };

  return (
-    <div className="fixed inset-0 bg-black/60 flex items-center justify-center z-50" onClick={onClose}>
-      <div className="bg-slate-800 border border-slate-600 rounded-xl p-6 w-full max-w-md shadow-2xl" onClick={e => e.stopPropagation()}>
-        <h2 className="text-lg font-semibold text-slate-200 mb-2">Reassign Owner</h2>
-        <p className="text-sm text-slate-400 mb-4">
+    <div className="fixed inset-0 bg-black/40 flex items-center justify-center z-50" onClick={onClose}>
+      <div className="bg-surface border border-surface-border rounded p-6 w-full max-w-md shadow-xl" onClick={e => e.stopPropagation()}>
+        <h2 className="text-lg font-semibold text-ink mb-2">Reassign Owner</h2>
+        <p className="text-sm text-ink-muted mb-4">
          Reassign {ids.length} certificate{ids.length > 1 ? 's' : ''} to a new owner.
        </p>
-        {error && <div className="bg-red-500/10 border border-red-500/20 text-red-400 rounded-lg px-3 py-2 text-sm mb-3">{error}</div>}
+        {error && <div className="bg-red-50 border border-red-200 text-red-700 rounded px-3 py-2 text-sm mb-3">{error}</div>}
        {running && (
          <div className="mb-3">
-            <div className="flex justify-between text-xs text-slate-400 mb-1">
+            <div className="flex justify-between text-xs text-ink-muted mb-1">
              <span>Progress</span>
              <span>{progress}/{ids.length}</span>
            </div>
-            <div className="w-full bg-slate-700 rounded-full h-2">
-              <div className="bg-blue-500 h-2 rounded-full transition-all" style={{ width: `${(progress / ids.length) * 100}%` }} />
+            <div className="w-full bg-surface-border rounded-full h-2">
+              <div className="bg-brand-400 h-2 rounded-full transition-all" style={{ width: `${(progress / ids.length) * 100}%` }} />
            </div>
          </div>
        )}
-        <label className="text-xs text-slate-400 block mb-2">New Owner</label>
+        <label className="text-xs text-ink-muted block mb-2">New Owner</label>
        <select value={ownerId} onChange={e => setOwnerId(e.target.value)}
-          className="w-full bg-slate-900 border border-slate-600 rounded-lg px-3 py-2 text-sm text-slate-200 mb-4"
+          className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink mb-4"
          disabled={running}
        >
          <option value="">Select owner...</option>
@@ -276,8 +276,8 @@ export default function CertificatesPage() {
      label: 'Certificate',
      render: (c) => (
        <div>
-          <div className="font-medium text-slate-200">{c.common_name}</div>
-          <div className="text-xs text-slate-500 mt-0.5">{c.id}</div>
+          <div className="font-medium text-ink">{c.common_name}</div>
+          <div className="text-xs text-ink-faint mt-0.5">{c.id}</div>
        </div>
      ),
    },
@@ -290,14 +290,14 @@ export default function CertificatesPage() {
        return (
          <div>
            <div className={expiryColor(days)}>{formatDate(c.expires_at)}</div>
-            <div className="text-xs text-slate-500">{days <= 0 ? 'Expired' : `${days} days`}</div>
+            <div className="text-xs text-ink-faint">{days <= 0 ? 'Expired' : `${days} days`}</div>
          </div>
        );
      },
    },
-    { key: 'env', label: 'Environment', render: (c) => <span className="text-slate-300">{c.environment || '—'}</span> },
-    { key: 'issuer', label: 'Issuer', render: (c) => <span className="text-slate-400 text-xs">{c.issuer_id}</span> },
-    { key: 'owner', label: 'Owner', render: (c) => <span className="text-slate-400 text-xs">{c.owner_id}</span> },
+    { key: 'env', label: 'Environment', render: (c) => <span className="text-ink-muted">{c.environment || '—'}</span> },
+    { key: 'issuer', label: 'Issuer', render: (c) => <span className="text-ink-muted text-xs">{c.issuer_id}</span> },
+    { key: 'owner', label: 'Owner', render: (c) => <span className="text-ink-muted text-xs">{c.owner_id}</span> },
  ];

  const selectedArray = Array.from(selectedIds);
@@ -317,8 +317,8 @@ export default function CertificatesPage() {

      {/* Bulk Action Bar */}
      {hasSelection && (
-        <div className="px-6 py-3 bg-blue-500/10 border-b border-blue-500/20 flex items-center justify-between">
-          <span className="text-sm text-blue-400 font-medium">{selectedArray.length} selected</span>
+        <div className="px-6 py-3 bg-brand-50 border-b border-brand-200 flex items-center justify-between">
+          <span className="text-sm text-brand-600 font-medium">{selectedArray.length} selected</span>
          <div className="flex gap-2">
            <button onClick={handleBulkRenewal} disabled={bulkRenewProgress?.running}
              className="btn btn-primary text-xs disabled:opacity-50">
@@ -331,11 +331,11 @@ export default function CertificatesPage() {
              Revoke
            </button>
            <button onClick={() => setShowBulkReassign(true)}
-              className="btn btn-ghost text-xs text-blue-400 hover:text-blue-300 border border-blue-600/50">
+              className="btn btn-ghost text-xs text-brand-400 hover:text-brand-300 border border-brand-600/50">
              Reassign Owner
            </button>
            <button onClick={() => setSelectedIds(new Set())}
-              className="btn btn-ghost text-xs text-slate-400">
+              className="btn btn-ghost text-xs text-ink-muted">
              Clear
            </button>
          </div>
@@ -344,18 +344,18 @@ export default function CertificatesPage() {

      {/* Bulk Renewal Success */}
      {bulkRenewProgress && !bulkRenewProgress.running && (
-        <div className="px-6 py-2 bg-emerald-500/10 border-b border-emerald-500/20">
-          <span className="text-sm text-emerald-400">
+        <div className="px-6 py-2 bg-emerald-50 border-b border-emerald-200">
+          <span className="text-sm text-emerald-700">
            Triggered renewal for {bulkRenewProgress.done} certificate{bulkRenewProgress.done > 1 ? 's' : ''}.
          </span>
        </div>
      )}

-      <div className="px-6 py-3 flex gap-3 border-b border-slate-700/50">
+      <div className="px-6 py-3 flex gap-3 border-b border-surface-border/50">
        <select
          value={statusFilter}
          onChange={e => setStatusFilter(e.target.value)}
-          className="bg-slate-800 border border-slate-600 rounded-lg px-3 py-1.5 text-sm text-slate-300"
+          className="bg-white border border-surface-border rounded px-3 py-1.5 text-sm text-ink"
        >
          <option value="">All statuses</option>
          <option value="Active">Active</option>
@@ -368,7 +368,7 @@ export default function CertificatesPage() {
        <select
          value={envFilter}
          onChange={e => setEnvFilter(e.target.value)}
-          className="bg-slate-800 border border-slate-600 rounded-lg px-3 py-1.5 text-sm text-slate-300"
+          className="bg-white border border-surface-border rounded px-3 py-1.5 text-sm text-ink"
        >
          <option value="">All environments</option>
          <option value="production">Production</option>
@@ -19,28 +19,29 @@ const STATUS_COLORS: Record<string, string> = {
  Expired: '#ef4444',
  Revoked: '#8b5cf6',
  Pending: '#6366f1',
-  RenewalInProgress: '#3b82f6',
+  RenewalInProgress: '#2ea88f',
  Failed: '#f43f5e',
  Archived: '#64748b',
 };

 function StatCard({ label, value, icon, color }: { label: string; value: string | number; icon: string; color: string }) {
-  const colorMap: Record<string, string> = {
-    success: 'bg-emerald-500/10 text-emerald-400',
-    warning: 'bg-amber-500/10 text-amber-400',
-    danger:  'bg-red-500/10 text-red-400',
-    info:    'bg-blue-500/10 text-blue-400',
+  const colorMap: Record<string, { bg: string; border: string; text: string }> = {
+    success: { bg: 'bg-emerald-50', border: 'border-t-emerald-500', text: 'text-emerald-700' },
+    warning: { bg: 'bg-amber-50', border: 'border-t-amber-500', text: 'text-amber-700' },
+    danger:  { bg: 'bg-red-50', border: 'border-t-red-500', text: 'text-red-700' },
+    info:    { bg: 'bg-blue-50', border: 'border-t-brand-400', text: 'text-brand-500' },
  };
+  const config = colorMap[color] || colorMap.info;
  return (
-    <div className="card p-5 flex items-start gap-4 hover:border-blue-500/30 transition-colors">
-      <div className={`w-10 h-10 rounded-lg flex items-center justify-center shrink-0 ${colorMap[color] || colorMap.info}`}>
+    <div className={`bg-surface border border-surface-border border-t-4 ${config.border} rounded p-5 flex items-start gap-4 hover:bg-surface-muted transition-colors shadow-sm`}>
+      <div className={`w-10 h-10 rounded flex items-center justify-center shrink-0 ${config.bg} ${config.text}`}>
        <svg className="w-5 h-5" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
          <path strokeLinecap="round" strokeLinejoin="round" d={icon} />
        </svg>
      </div>
      <div>
-        <p className="text-xs font-semibold text-slate-400 uppercase tracking-wider">{label}</p>
-        <p className="text-2xl font-bold mt-1">{value}</p>
+        <p className="text-xs font-semibold text-ink-muted uppercase tracking-wider">{label}</p>
+        <p className="text-2xl font-bold mt-1 text-ink">{value}</p>
      </div>
    </div>
  );
@@ -48,8 +49,8 @@ function StatCard({ label, value, icon, color }: { label: string; value: string

 function ChartCard({ title, children }: { title: string; children: React.ReactNode }) {
  return (
-    <div className="card p-5">
-      <h3 className="text-sm font-semibold text-slate-300 mb-4">{title}</h3>
+    <div className="bg-surface border border-surface-border rounded p-5 shadow-sm">
+      <h3 className="text-sm font-semibold text-ink-muted mb-4">{title}</h3>
      <div className="h-64">
        {children}
      </div>
@@ -60,8 +61,8 @@ function ChartCard({ title, children }: { title: string; children: React.ReactNo
 const CustomTooltip = ({ active, payload, label }: any) => {
  if (!active || !payload?.length) return null;
  return (
-    <div className="bg-slate-800 border border-slate-600 rounded-lg px-3 py-2 text-xs shadow-lg">
-      <p className="text-slate-300 mb-1">{label}</p>
+    <div className="bg-surface border border-surface-border rounded px-3 py-2 text-xs shadow-lg">
+      <p className="text-ink mb-1">{label}</p>
      {payload.map((entry: any, i: number) => (
        <p key={i} style={{ color: entry.color }}>
          {entry.name}: {typeof entry.value === 'number' && entry.name?.includes('rate') ? `${entry.value.toFixed(1)}%` : entry.value}
@@ -159,12 +160,12 @@ export default function DashboardPage() {
                  <Legend
                    verticalAlign="bottom"
                    height={36}
-                    formatter={(value: string) => <span className="text-xs text-slate-400">{value}</span>}
+                    formatter={(value: string) => <span className="text-xs text-ink-muted">{value}</span>}
                  />
                </PieChart>
              </ResponsiveContainer>
            ) : (
-              <div className="h-full flex items-center justify-center text-sm text-slate-500">No certificate data</div>
+              <div className="h-full flex items-center justify-center text-sm text-ink-faint">No certificate data</div>
            )}
          </ChartCard>

@@ -173,15 +174,15 @@ export default function DashboardPage() {
            {weeklyExpiration.length > 0 ? (
              <ResponsiveContainer width="100%" height="100%">
                <BarChart data={weeklyExpiration}>
-                  <CartesianGrid strokeDasharray="3 3" stroke="#334155" />
-                  <XAxis dataKey="week" tick={{ fill: '#94a3b8', fontSize: 11 }} tickFormatter={formatShortDate} />
-                  <YAxis tick={{ fill: '#94a3b8', fontSize: 11 }} allowDecimals={false} />
+                  <CartesianGrid strokeDasharray="3 3" stroke="#e2e8f0" />
+                  <XAxis dataKey="week" tick={{ fill: '#64748b', fontSize: 11 }} tickFormatter={formatShortDate} />
+                  <YAxis tick={{ fill: '#64748b', fontSize: 11 }} allowDecimals={false} />
                  <Tooltip content={<CustomTooltip />} />
                  <Bar dataKey="count" name="Expiring certs" fill="#f59e0b" radius={[4, 4, 0, 0]} />
                </BarChart>
              </ResponsiveContainer>
            ) : (
-              <div className="h-full flex items-center justify-center text-sm text-slate-500">No expiration data</div>
+              <div className="h-full flex items-center justify-center text-sm text-ink-faint">No expiration data</div>
            )}
          </ChartCard>
        </div>
@@ -193,17 +194,17 @@ export default function DashboardPage() {
            {(jobTrends || []).length > 0 ? (
              <ResponsiveContainer width="100%" height="100%">
                <LineChart data={jobTrends}>
-                  <CartesianGrid strokeDasharray="3 3" stroke="#334155" />
-                  <XAxis dataKey="date" tick={{ fill: '#94a3b8', fontSize: 11 }} tickFormatter={formatShortDate} />
-                  <YAxis tick={{ fill: '#94a3b8', fontSize: 11 }} allowDecimals={false} />
+                  <CartesianGrid strokeDasharray="3 3" stroke="#e2e8f0" />
+                  <XAxis dataKey="date" tick={{ fill: '#64748b', fontSize: 11 }} tickFormatter={formatShortDate} />
+                  <YAxis tick={{ fill: '#64748b', fontSize: 11 }} allowDecimals={false} />
                  <Tooltip content={<CustomTooltip />} />
-                  <Legend formatter={(value: string) => <span className="text-xs text-slate-400">{value}</span>} />
+                  <Legend formatter={(value: string) => <span className="text-xs text-ink-muted">{value}</span>} />
                  <Line type="monotone" dataKey="completed_count" name="Completed" stroke="#10b981" strokeWidth={2} dot={false} />
                  <Line type="monotone" dataKey="failed_count" name="Failed" stroke="#ef4444" strokeWidth={2} dot={false} />
                </LineChart>
              </ResponsiveContainer>
            ) : (
-              <div className="h-full flex items-center justify-center text-sm text-slate-500">No job trend data</div>
+              <div className="h-full flex items-center justify-center text-sm text-ink-faint">No job trend data</div>
            )}
          </ChartCard>

@@ -212,28 +213,28 @@ export default function DashboardPage() {
            {(issuanceRate || []).length > 0 ? (
              <ResponsiveContainer width="100%" height="100%">
                <BarChart data={issuanceRate}>
-                  <CartesianGrid strokeDasharray="3 3" stroke="#334155" />
-                  <XAxis dataKey="date" tick={{ fill: '#94a3b8', fontSize: 11 }} tickFormatter={formatShortDate} />
-                  <YAxis tick={{ fill: '#94a3b8', fontSize: 11 }} allowDecimals={false} />
+                  <CartesianGrid strokeDasharray="3 3" stroke="#e2e8f0" />
+                  <XAxis dataKey="date" tick={{ fill: '#64748b', fontSize: 11 }} tickFormatter={formatShortDate} />
+                  <YAxis tick={{ fill: '#64748b', fontSize: 11 }} allowDecimals={false} />
                  <Tooltip content={<CustomTooltip />} />
-                  <Bar dataKey="issued_count" name="Issued" fill="#3b82f6" radius={[4, 4, 0, 0]} />
+                  <Bar dataKey="issued_count" name="Issued" fill="#2ea88f" radius={[4, 4, 0, 0]} />
                </BarChart>
              </ResponsiveContainer>
            ) : (
-              <div className="h-full flex items-center justify-center text-sm text-slate-500">No issuance data</div>
+              <div className="h-full flex items-center justify-center text-sm text-ink-faint">No issuance data</div>
            )}
          </ChartCard>
        </div>

        <div className="grid grid-cols-1 lg:grid-cols-2 gap-6">
          {/* Expiring Certificates */}
-          <div className="card p-5">
+          <div className="bg-surface border border-surface-border rounded p-5 shadow-sm">
            <div className="flex items-center justify-between mb-4">
-              <h3 className="text-sm font-semibold text-slate-300">Certificates Expiring Soon</h3>
-              <button onClick={() => navigate('/certificates')} className="text-xs text-blue-400 hover:text-blue-300">View all</button>
+              <h3 className="text-sm font-semibold text-ink-muted">Certificates Expiring Soon</h3>
+              <button onClick={() => navigate('/certificates')} className="text-xs text-brand-400 hover:text-brand-500">View all</button>
            </div>
            {!certs?.data?.length ? (
-              <p className="text-sm text-slate-500">No certificates</p>
+              <p className="text-sm text-ink-faint">No certificates</p>
            ) : (
              <div className="space-y-2">
                {certs.data
@@ -246,17 +247,17 @@ export default function DashboardPage() {
                      <div
                        key={c.id}
                        onClick={() => navigate(`/certificates/${c.id}`)}
-                        className="flex items-center justify-between py-2 px-3 rounded-lg hover:bg-slate-700/50 cursor-pointer transition-colors"
+                        className="flex items-center justify-between py-2 px-3 rounded hover:bg-surface-muted cursor-pointer transition-colors"
                      >
                        <div>
-                          <div className="text-sm text-slate-200">{c.common_name}</div>
-                          <div className="text-xs text-slate-500">{c.environment || 'no env'}</div>
+                          <div className="text-sm text-ink">{c.common_name}</div>
+                          <div className="text-xs text-ink-faint">{c.environment || 'no env'}</div>
                        </div>
                        <div className="text-right">
                          <div className={`text-sm ${expiryColor(days)}`}>
                            {days <= 0 ? 'Expired' : `${days} days`}
                          </div>
-                          <div className="text-xs text-slate-500">{formatDate(c.expires_at)}</div>
+                          <div className="text-xs text-ink-faint">{formatDate(c.expires_at)}</div>
                        </div>
                      </div>
                    );
@@ -266,20 +267,20 @@ export default function DashboardPage() {
          </div>

          {/* Recent Jobs */}
-          <div className="card p-5">
+          <div className="bg-surface border border-surface-border rounded p-5 shadow-sm">
            <div className="flex items-center justify-between mb-4">
-              <h3 className="text-sm font-semibold text-slate-300">Recent Jobs</h3>
-              <button onClick={() => navigate('/jobs')} className="text-xs text-blue-400 hover:text-blue-300">View all</button>
+              <h3 className="text-sm font-semibold text-ink-muted">Recent Jobs</h3>
+              <button onClick={() => navigate('/jobs')} className="text-xs text-brand-400 hover:text-brand-500">View all</button>
            </div>
            {!jobs?.data?.length ? (
-              <p className="text-sm text-slate-500">No jobs</p>
+              <p className="text-sm text-ink-faint">No jobs</p>
            ) : (
              <div className="space-y-2">
                {jobs.data.slice(0, 5).map(j => (
-                  <div key={j.id} className="flex items-center justify-between py-2 px-3 rounded-lg hover:bg-slate-700/50 transition-colors">
+                  <div key={j.id} className="flex items-center justify-between py-2 px-3 rounded hover:bg-surface-muted transition-colors">
                    <div>
-                      <div className="text-sm text-slate-200">{j.type}</div>
-                      <div className="text-xs text-slate-500 font-mono">{j.certificate_id}</div>
+                      <div className="text-sm text-ink">{j.type}</div>
+                      <div className="text-xs text-ink-faint font-mono">{j.certificate_id}</div>
                    </div>
                    <StatusBadge status={j.status} />
                  </div>
@@ -291,10 +292,10 @@ export default function DashboardPage() {

        {/* Pending Jobs Banner */}
        {pendingJobs > 0 && (
-          <div className="bg-blue-500/10 border border-blue-500/20 rounded-lg px-5 py-4 flex items-center justify-between">
+          <div className="bg-brand-50 border border-brand-200 rounded px-5 py-4 flex items-center justify-between">
            <div>
-              <p className="text-sm font-medium text-blue-400">{pendingJobs} pending job{pendingJobs > 1 ? 's' : ''}</p>
-              <p className="text-xs text-slate-400 mt-0.5">Jobs are waiting to be processed</p>
+              <p className="text-sm font-medium text-brand-600">{pendingJobs} pending job{pendingJobs > 1 ? 's' : ''}</p>
+              <p className="text-xs text-brand-600/70 mt-0.5">Jobs are waiting to be processed</p>
            </div>
            <button onClick={() => navigate('/jobs')} className="btn btn-primary text-xs">View Jobs</button>
          </div>
@@ -42,8 +42,8 @@ export default function IssuersPage() {
      label: 'Issuer',
      render: (i) => (
        <div>
-          <div className="font-medium text-slate-200">{i.name}</div>
-          <div className="text-xs text-slate-500 font-mono">{i.id}</div>
+          <div className="font-medium text-ink">{i.name}</div>
+          <div className="text-xs text-ink-faint font-mono">{i.id}</div>
        </div>
      ),
    },
@@ -63,9 +63,9 @@ export default function IssuersPage() {
      key: 'config',
      label: 'Config',
      render: (i) => {
-        if (!i.config || Object.keys(i.config).length === 0) return <span className="text-slate-500">&mdash;</span>;
+        if (!i.config || Object.keys(i.config).length === 0) return <span className="text-ink-faint">&mdash;</span>;
        return (
-          <span className="text-xs text-slate-400 font-mono truncate max-w-xs block">
+          <span className="text-xs text-ink-muted font-mono truncate max-w-xs block">
            {JSON.stringify(i.config).slice(0, 60)}
          </span>
        );
@@ -74,7 +74,7 @@ export default function IssuersPage() {
    {
      key: 'created',
      label: 'Created',
-      render: (i) => <span className="text-xs text-slate-400">{formatDateTime(i.created_at)}</span>,
+      render: (i) => <span className="text-xs text-ink-muted">{formatDateTime(i.created_at)}</span>,
    },
    {
      key: 'actions',
@@ -84,13 +84,13 @@ export default function IssuersPage() {
          <button
            onClick={(e) => { e.stopPropagation(); testMutation.mutate(i.id); }}
            disabled={testMutation.isPending}
-            className="text-xs text-blue-400 hover:text-blue-300 transition-colors"
+            className="text-xs text-brand-400 hover:text-brand-500 transition-colors"
          >
            Test
          </button>
          <button
            onClick={(e) => { e.stopPropagation(); if (confirm(`Delete issuer ${i.name}?`)) deleteMutation.mutate(i.id); }}
-            className="text-xs text-red-400 hover:text-red-300 transition-colors"
+            className="text-xs text-red-600 hover:text-red-700 transition-colors"
          >
            Delete
          </button>
@@ -103,7 +103,7 @@ export default function IssuersPage() {
    <>
      <PageHeader title="Issuers" subtitle={data ? `${data.total} issuers` : undefined} />
      {testResult && (
-        <div className={`mx-6 mt-3 rounded-lg px-4 py-3 text-sm ${testResult.ok ? 'bg-emerald-500/10 border border-emerald-500/20 text-emerald-400' : 'bg-red-500/10 border border-red-500/20 text-red-400'}`}>
+        <div className={`mx-6 mt-3 rounded px-4 py-3 text-sm ${testResult.ok ? 'bg-emerald-100 border border-emerald-200 text-emerald-700' : 'bg-red-50 border border-red-200 text-red-700'}`}>
          {testResult.id}: {testResult.msg}
          <button onClick={() => setTestResult(null)} className="ml-3 text-xs opacity-60 hover:opacity-100">dismiss</button>
        </div>
@@ -35,20 +35,20 @@ export default function JobsPage() {
      label: 'Job',
      render: (j) => (
        <div>
-          <div className="font-mono text-xs text-slate-200">{j.id}</div>
-          <div className="text-xs text-slate-500">{j.type}</div>
+          <div className="font-mono text-xs text-ink">{j.id}</div>
+          <div className="text-xs text-ink-faint">{j.type}</div>
        </div>
      ),
    },
    { key: 'status', label: 'Status', render: (j) => <StatusBadge status={j.status} /> },
-    { key: 'cert', label: 'Certificate', render: (j) => <span className="text-xs text-slate-400 font-mono">{j.certificate_id}</span> },
+    { key: 'cert', label: 'Certificate', render: (j) => <span className="text-xs text-ink-muted font-mono">{j.certificate_id}</span> },
    {
      key: 'attempts',
      label: 'Attempts',
-      render: (j) => <span className="text-slate-300">{j.attempts}/{j.max_attempts}</span>,
+      render: (j) => <span className="text-ink-muted">{j.attempts}/{j.max_attempts}</span>,
    },
-    { key: 'scheduled', label: 'Scheduled', render: (j) => <span className="text-xs text-slate-400">{formatDateTime(j.scheduled_at)}</span> },
-    { key: 'completed', label: 'Completed', render: (j) => <span className="text-xs text-slate-400">{formatDateTime(j.completed_at)}</span> },
+    { key: 'scheduled', label: 'Scheduled', render: (j) => <span className="text-xs text-ink-muted">{formatDateTime(j.scheduled_at)}</span> },
+    { key: 'completed', label: 'Completed', render: (j) => <span className="text-xs text-ink-muted">{formatDateTime(j.completed_at)}</span> },
    {
      key: 'actions',
      label: '',
@@ -68,11 +68,11 @@ export default function JobsPage() {
  return (
    <>
      <PageHeader title="Jobs" subtitle={data ? `${data.total} jobs` : undefined} />
-      <div className="px-6 py-3 flex gap-3 border-b border-slate-700/50">
+      <div className="px-6 py-3 flex gap-3 border-b border-surface-border/50">
        <select
          value={statusFilter}
          onChange={e => setStatusFilter(e.target.value)}
-          className="bg-slate-800 border border-slate-600 rounded-lg px-3 py-1.5 text-sm text-slate-300"
+          className="bg-white border border-surface-border rounded px-3 py-1.5 text-sm text-ink"
        >
          <option value="">All statuses</option>
          <option value="Pending">Pending</option>
@@ -84,7 +84,7 @@ export default function JobsPage() {
        <select
          value={typeFilter}
          onChange={e => setTypeFilter(e.target.value)}
-          className="bg-slate-800 border border-slate-600 rounded-lg px-3 py-1.5 text-sm text-slate-300"
+          className="bg-white border border-surface-border rounded px-3 py-1.5 text-sm text-ink"
        >
          <option value="">All types</option>
          <option value="Renewal">Renewal</option>
@@ -24,16 +24,16 @@ export default function LoginPage() {
  }

  return (
-    <div className="min-h-screen bg-slate-900 flex items-center justify-center px-4">
+    <div className="min-h-screen bg-page flex items-center justify-center px-4">
      <div className="w-full max-w-sm">
        <div className="text-center mb-8">
-          <h1 className="text-3xl font-bold text-blue-400 mb-2">certctl</h1>
-          <p className="text-sm text-slate-400 uppercase tracking-wider">Certificate Control Plane</p>
+          <h1 className="text-4xl font-bold text-brand-400 mb-2">certctl</h1>
+          <p className="text-sm text-ink-muted uppercase tracking-wider">Certificate Control Plane</p>
        </div>

-        <form onSubmit={handleSubmit} className="card p-6 space-y-4">
+        <form onSubmit={handleSubmit} className="bg-surface border border-surface-border rounded p-6 space-y-4 shadow-sm">
          <div>
-            <label htmlFor="api-key" className="block text-sm font-medium text-slate-300 mb-1.5">
+            <label htmlFor="api-key" className="block text-sm font-medium text-ink-muted mb-1.5">
              API Key
            </label>
            <input
@@ -43,12 +43,12 @@ export default function LoginPage() {
              onChange={(e) => setKey(e.target.value)}
              placeholder="Enter your API key"
              autoFocus
-              className="w-full bg-slate-700 border border-slate-600 rounded-lg px-3 py-2.5 text-sm text-slate-200 placeholder-slate-500 focus:outline-none focus:border-blue-500 focus:ring-1 focus:ring-blue-500"
+              className="w-full bg-white border border-surface-border rounded px-3 py-2.5 text-sm text-ink placeholder-ink-faint focus:outline-none focus:border-brand-400 focus:ring-1 focus:ring-brand-400/20"
            />
          </div>

          {error && (
-            <div className="bg-red-500/10 border border-red-500/30 rounded-lg px-3 py-2 text-sm text-red-400">
+            <div className="bg-red-50 border border-red-200 rounded px-3 py-2 text-sm text-red-700">
              {error}
            </div>
          )}
@@ -56,13 +56,13 @@ export default function LoginPage() {
          <button
            type="submit"
            disabled={submitting || !key.trim()}
-            className="w-full btn-primary py-2.5 text-sm font-medium rounded-lg disabled:opacity-50 disabled:cursor-not-allowed"
+            className="w-full bg-brand-400 hover:bg-brand-500 text-white py-2.5 text-sm font-medium rounded transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
          >
            {submitting ? 'Verifying...' : 'Sign In'}
          </button>

-          <p className="text-xs text-slate-500 text-center">
-            The API key is set via <code className="text-slate-400">CERTCTL_AUTH_SECRET</code> on the server.
+          <p className="text-xs text-ink-muted text-center">
+            The API key is set via <code className="text-ink-faint bg-page px-1 py-0.5 rounded">CERTCTL_AUTH_SECRET</code> on the server.
          </p>
        </form>
      </div>
@@ -60,7 +60,7 @@ export default function NotificationsPage() {
    return (
      <>
        <PageHeader title="Notifications" />
-        <div className="flex items-center justify-center flex-1 text-slate-400">Loading...</div>
+        <div className="flex items-center justify-center flex-1 text-ink-muted">Loading...</div>
      </>
    );
  }
@@ -80,17 +80,17 @@ export default function NotificationsPage() {
        title="Notifications"
        subtitle={`${filtered.length} notifications${unreadCount ? ` (${unreadCount} unread)` : ''}`}
      />
-      <div className="px-4 py-3 flex flex-wrap items-center gap-3 border-b border-slate-700/50">
-        <div className="flex rounded overflow-hidden border border-slate-600">
+      <div className="px-4 py-3 flex flex-wrap items-center gap-3 border-b border-surface-border/50">
+        <div className="flex rounded overflow-hidden border border-surface-border">
          <button
            onClick={() => setViewMode('grouped')}
-            className={`px-3 py-1.5 text-xs transition-colors ${viewMode === 'grouped' ? 'bg-blue-600 text-white' : 'bg-slate-800 text-slate-400 hover:text-slate-200'}`}
+            className={`px-3 py-1.5 text-xs transition-colors ${viewMode === 'grouped' ? 'bg-brand-400 text-white' : 'bg-surface text-ink-muted hover:text-ink'}`}
          >
            Grouped
          </button>
          <button
            onClick={() => setViewMode('list')}
-            className={`px-3 py-1.5 text-xs transition-colors ${viewMode === 'list' ? 'bg-blue-600 text-white' : 'bg-slate-800 text-slate-400 hover:text-slate-200'}`}
+            className={`px-3 py-1.5 text-xs transition-colors ${viewMode === 'list' ? 'bg-brand-400 text-white' : 'bg-surface text-ink-muted hover:text-ink'}`}
          >
            List
          </button>
@@ -98,7 +98,7 @@ export default function NotificationsPage() {
        <select
          value={typeFilter}
          onChange={(e) => setTypeFilter(e.target.value)}
-          className="bg-slate-800 border border-slate-600 rounded px-3 py-1.5 text-xs text-slate-300 focus:outline-none focus:border-blue-500"
+          className="bg-surface border border-surface-border rounded px-3 py-1.5 text-xs text-ink focus:outline-none focus:border-brand-400"
        >
          <option value="">All types</option>
          {types.map(t => <option key={t} value={t}>{t.replace(/([A-Z])/g, ' $1').trim()}</option>)}
@@ -106,7 +106,7 @@ export default function NotificationsPage() {
        <select
          value={statusFilter}
          onChange={(e) => setStatusFilter(e.target.value)}
-          className="bg-slate-800 border border-slate-600 rounded px-3 py-1.5 text-xs text-slate-300 focus:outline-none focus:border-blue-500"
+          className="bg-surface border border-surface-border rounded px-3 py-1.5 text-xs text-ink focus:outline-none focus:border-brand-400"
        >
          <option value="">All statuses</option>
          {statuses.map(s => <option key={s} value={s}>{s}</option>)}
@@ -114,7 +114,7 @@ export default function NotificationsPage() {
        {(typeFilter || statusFilter) && (
          <button
            onClick={() => { setTypeFilter(''); setStatusFilter(''); }}
-            className="text-xs text-slate-400 hover:text-slate-200 transition-colors"
+            className="text-xs text-ink-muted hover:text-ink transition-colors"
          >
            Clear filters
          </button>
@@ -123,15 +123,15 @@ export default function NotificationsPage() {
      <div className="flex-1 overflow-y-auto p-4 space-y-3">
        {viewMode === 'grouped' ? (
          grouped.length === 0 ? (
-            <div className="text-center py-16 text-slate-500">No notifications</div>
+            <div className="text-center py-16 text-ink-faint">No notifications</div>
          ) : (
            grouped.map(([certId, items]) => (
              <div key={certId} className="card p-4">
                <div className="flex items-center justify-between mb-3">
-                  <span className="text-xs font-mono text-slate-400">
+                  <span className="text-xs font-mono text-ink-muted">
                    {certId === 'general' ? 'General' : certId}
                  </span>
-                  <span className="text-xs text-slate-500">{items.length} notification{items.length !== 1 ? 's' : ''}</span>
+                  <span className="text-xs text-ink-faint">{items.length} notification{items.length !== 1 ? 's' : ''}</span>
                </div>
                <div className="space-y-2">
                  {items.map((n) => (
@@ -143,7 +143,7 @@ export default function NotificationsPage() {
          )
        ) : (
          filtered.length === 0 ? (
-            <div className="text-center py-16 text-slate-500">No notifications</div>
+            <div className="text-center py-16 text-ink-faint">No notifications</div>
          ) : (
            <div className="space-y-2">
              {filtered.map((n) => (
@@ -160,23 +160,23 @@ export default function NotificationsPage() {
 function NotificationRow({ notification: n, onMarkRead }: { notification: Notification; onMarkRead: () => void }) {
  const isUnread = n.status === 'Pending' || n.status === 'pending';
  return (
-    <div className={`flex items-start justify-between py-2 px-3 rounded-lg transition-colors ${isUnread ? 'bg-slate-700/30 border-l-2 border-blue-500' : 'hover:bg-slate-700/20'}`}>
+    <div className={`flex items-start justify-between py-2 px-3 rounded transition-colors ${isUnread ? 'bg-surface-muted border-l-2 border-brand-400' : 'hover:bg-surface-muted'}`}>
      <div className="flex-1 min-w-0">
        <div className="flex items-center gap-2 mb-1">
-          <span className="text-sm text-slate-200">{n.type.replace(/([A-Z])/g, ' $1').trim()}</span>
+          <span className="text-sm text-ink">{n.type.replace(/([A-Z])/g, ' $1').trim()}</span>
          <StatusBadge status={n.status} />
-          <span className="text-xs text-slate-500">{n.channel}</span>
+          <span className="text-xs text-ink-faint">{n.channel}</span>
        </div>
-        <p className="text-xs text-slate-400 truncate">{n.message || n.subject}</p>
+        <p className="text-xs text-ink-muted truncate">{n.message || n.subject}</p>
        <div className="flex items-center gap-3 mt-1">
-          <span className="text-xs text-slate-500">{n.recipient}</span>
-          <span className="text-xs text-slate-600">{timeAgo(n.created_at)}</span>
+          <span className="text-xs text-ink-faint">{n.recipient}</span>
+          <span className="text-xs text-ink-faint">{timeAgo(n.created_at)}</span>
        </div>
      </div>
      {isUnread && (
        <button
          onClick={(e) => { e.stopPropagation(); onMarkRead(); }}
-          className="ml-3 text-xs text-blue-400 hover:text-blue-300 transition-colors whitespace-nowrap"
+          className="ml-3 text-xs text-brand-400 hover:text-brand-500 transition-colors whitespace-nowrap"
        >
          Mark read
        </button>
@@ -35,15 +35,15 @@ export default function OwnersPage() {
      label: 'Owner',
      render: (o) => (
        <div>
-          <div className="font-medium text-slate-200">{o.name}</div>
-          <div className="text-xs text-slate-500 font-mono">{o.id}</div>
+          <div className="font-medium text-ink">{o.name}</div>
+          <div className="text-xs text-ink-faint font-mono">{o.id}</div>
        </div>
      ),
    },
    {
      key: 'email',
      label: 'Email',
-      render: (o) => <span className="text-slate-300">{o.email || '\u2014'}</span>,
+      render: (o) => <span className="text-ink">{o.email || '\u2014'}</span>,
    },
    {
      key: 'team',
@@ -51,14 +51,14 @@ export default function OwnersPage() {
      render: (o) => {
        const team = teamMap.get(o.team_id);
        return team
-          ? <span className="text-blue-400">{team.name}</span>
-          : <span className="text-slate-500 font-mono text-xs">{o.team_id || '\u2014'}</span>;
+          ? <span className="text-brand-400">{team.name}</span>
+          : <span className="text-ink-faint font-mono text-xs">{o.team_id || '\u2014'}</span>;
      },
    },
    {
      key: 'created',
      label: 'Created',
-      render: (o) => <span className="text-xs text-slate-400">{formatDateTime(o.created_at)}</span>,
+      render: (o) => <span className="text-xs text-ink-muted">{formatDateTime(o.created_at)}</span>,
    },
    {
      key: 'actions',
@@ -66,7 +66,7 @@ export default function OwnersPage() {
      render: (o) => (
        <button
          onClick={(e) => { e.stopPropagation(); if (confirm(`Delete owner ${o.name}?`)) deleteMutation.mutate(o.id); }}
-          className="text-xs text-red-400 hover:text-red-300 transition-colors"
+          className="text-xs text-red-600 hover:text-red-700 transition-colors"
        >
          Delete
        </button>
@@ -15,10 +15,10 @@ const severityStyles: Record<string, string> = {
 };

 const severityDots: Record<string, string> = {
-  low: 'bg-blue-400',
-  medium: 'bg-amber-400',
-  high: 'bg-orange-400',
-  critical: 'bg-red-400',
+  low: 'bg-emerald-500',
+  medium: 'bg-amber-500',
+  high: 'bg-orange-500',
+  critical: 'bg-red-500',
 };

 export default function PoliciesPage() {
@@ -52,12 +52,12 @@ export default function PoliciesPage() {
      label: 'Rule',
      render: (p) => (
        <div>
-          <div className="font-medium text-slate-200">{p.name}</div>
-          <div className="text-xs text-slate-500">{p.id}</div>
+          <div className="font-medium text-ink">{p.name}</div>
+          <div className="text-xs text-ink-faint">{p.id}</div>
        </div>
      ),
    },
-    { key: 'type', label: 'Type', render: (p) => <span className="text-sm text-slate-300">{p.type.replace(/_/g, ' ')}</span> },
+    { key: 'type', label: 'Type', render: (p) => <span className="text-sm text-ink">{p.type.replace(/_/g, ' ')}</span> },
    {
      key: 'severity',
      label: 'Severity',
@@ -67,9 +67,9 @@ export default function PoliciesPage() {
      key: 'config',
      label: 'Config',
      render: (p) => {
-        if (!p.config || Object.keys(p.config).length === 0) return <span className="text-slate-500">&mdash;</span>;
+        if (!p.config || Object.keys(p.config).length === 0) return <span className="text-ink-faint">&mdash;</span>;
        return (
-          <span className="text-xs text-slate-400 font-mono truncate max-w-xs block">
+          <span className="text-xs text-ink-muted font-mono truncate max-w-xs block">
            {JSON.stringify(p.config).slice(0, 50)}
          </span>
        );
@@ -81,20 +81,20 @@ export default function PoliciesPage() {
      render: (p) => (
        <button
          onClick={(e) => { e.stopPropagation(); toggleMutation.mutate({ id: p.id, enabled: !p.enabled }); }}
-          className={`text-xs font-medium transition-colors ${p.enabled ? 'text-emerald-400 hover:text-emerald-300' : 'text-slate-500 hover:text-slate-300'}`}
+          className={`text-xs font-medium transition-colors ${p.enabled ? 'text-emerald-600 hover:text-emerald-700' : 'text-ink-faint hover:text-ink-muted'}`}
        >
          {p.enabled ? 'Enabled' : 'Disabled'}
        </button>
      ),
    },
-    { key: 'created', label: 'Created', render: (p) => <span className="text-xs text-slate-400">{formatDateTime(p.created_at)}</span> },
+    { key: 'created', label: 'Created', render: (p) => <span className="text-xs text-ink-muted">{formatDateTime(p.created_at)}</span> },
    {
      key: 'actions',
      label: '',
      render: (p) => (
        <button
          onClick={(e) => { e.stopPropagation(); if (confirm(`Delete policy ${p.name}?`)) deleteMutation.mutate(p.id); }}
-          className="text-xs text-red-400 hover:text-red-300 transition-colors"
+          className="text-xs text-red-600 hover:text-red-700 transition-colors"
        >
          Delete
        </button>
@@ -106,18 +106,18 @@ export default function PoliciesPage() {
    <>
      <PageHeader title="Policies" subtitle={data ? `${data.total} rules` : undefined} />
      {policies.length > 0 && (
-        <div className="px-4 py-3 flex flex-wrap gap-4 border-b border-slate-700/50">
+        <div className="px-4 py-3 flex flex-wrap gap-4 border-b border-surface-border/50">
          <div className="flex items-center gap-2">
-            <span className="text-xs text-slate-400">Enabled:</span>
-            <span className="text-xs font-medium text-emerald-400">{enabledCount}</span>
-            <span className="text-xs text-slate-600">/</span>
-            <span className="text-xs text-slate-400">{policies.length}</span>
+            <span className="text-xs text-ink-muted">Enabled:</span>
+            <span className="text-xs font-medium text-emerald-600">{enabledCount}</span>
+            <span className="text-xs text-ink-faint">/</span>
+            <span className="text-xs text-ink-muted">{policies.length}</span>
          </div>
          {Object.entries(bySeverity).map(([sev, count]) => (
            <div key={sev} className="flex items-center gap-1.5">
              <div className={`w-2 h-2 rounded-full ${severityDots[sev] || 'bg-slate-400'}`} />
-              <span className="text-xs text-slate-300 capitalize">{sev}</span>
-              <span className="text-xs text-slate-500">{count}</span>
+              <span className="text-xs text-ink capitalize">{sev}</span>
+              <span className="text-xs text-ink-faint">{count}</span>
            </div>
          ))}
        </div>
@@ -35,10 +35,10 @@ export default function ProfilesPage() {
      label: 'Profile',
      render: (p) => (
        <div>
-          <div className="font-medium text-slate-200">{p.name}</div>
-          <div className="text-xs text-slate-500 font-mono">{p.id}</div>
+          <div className="font-medium text-ink">{p.name}</div>
+          <div className="text-xs text-ink-faint font-mono">{p.id}</div>
          {p.description && (
-            <div className="text-xs text-slate-400 mt-0.5 max-w-xs truncate">{p.description}</div>
+            <div className="text-xs text-ink-muted mt-0.5 max-w-xs truncate">{p.description}</div>
          )}
        </div>
      ),
@@ -61,9 +61,9 @@ export default function ProfilesPage() {
      label: 'Max TTL',
      render: (p) => (
        <div>
-          <span className="text-slate-200">{formatTTL(p.max_ttl_seconds)}</span>
+          <span className="text-ink">{formatTTL(p.max_ttl_seconds)}</span>
          {p.allow_short_lived && (
-            <span className="ml-2 text-xs text-amber-400 bg-amber-400/10 px-1.5 py-0.5 rounded">
+            <span className="ml-2 text-xs text-amber-700 bg-amber-100 px-1.5 py-0.5 rounded">
              short-lived
            </span>
          )}
@@ -76,7 +76,7 @@ export default function ProfilesPage() {
      render: (p) => (
        <div className="flex flex-wrap gap-1">
          {(p.allowed_ekus || []).map((eku, i) => (
-            <span key={i} className="text-xs text-slate-400">{eku}</span>
+            <span key={i} className="text-xs text-ink-muted">{eku}</span>
          ))}
        </div>
      ),
@@ -86,8 +86,8 @@ export default function ProfilesPage() {
      label: 'SPIFFE',
      render: (p) => (
        p.spiffe_uri_pattern
-          ? <span className="text-xs text-blue-400 font-mono">{p.spiffe_uri_pattern}</span>
-          : <span className="text-slate-500">&mdash;</span>
+          ? <span className="text-xs text-brand-400 font-mono">{p.spiffe_uri_pattern}</span>
+          : <span className="text-ink-faint">&mdash;</span>
      ),
    },
    {
@@ -98,7 +98,7 @@ export default function ProfilesPage() {
    {
      key: 'created',
      label: 'Created',
-      render: (p) => <span className="text-xs text-slate-400">{formatDateTime(p.created_at)}</span>,
+      render: (p) => <span className="text-xs text-ink-muted">{formatDateTime(p.created_at)}</span>,
    },
    {
      key: 'actions',
@@ -106,7 +106,7 @@ export default function ProfilesPage() {
      render: (p) => (
        <button
          onClick={(e) => { e.stopPropagation(); if (confirm(`Delete profile ${p.name}?`)) deleteMutation.mutate(p.id); }}
-          className="text-xs text-red-400 hover:text-red-300 transition-colors"
+          className="text-xs text-red-600 hover:text-red-700 transition-colors"
        >
          Delete
        </button>
@@ -19,10 +19,10 @@ function formatTTL(seconds: number): string {
 function ttlRemaining(expiresAt: string): { text: string; color: string; seconds: number } {
  const diff = new Date(expiresAt).getTime() - Date.now();
  const secs = Math.floor(diff / 1000);
-  if (secs <= 0) return { text: 'Expired', color: 'text-red-400', seconds: 0 };
-  if (secs < 300) return { text: `${secs}s`, color: 'text-red-400', seconds: secs };
-  if (secs < 1800) return { text: `${Math.round(secs / 60)}m`, color: 'text-amber-400', seconds: secs };
-  return { text: formatTTL(secs), color: 'text-emerald-400', seconds: secs };
+  if (secs <= 0) return { text: 'Expired', color: 'text-red-600', seconds: 0 };
+  if (secs < 300) return { text: `${secs}s`, color: 'text-red-600', seconds: secs };
+  if (secs < 1800) return { text: `${Math.round(secs / 60)}m`, color: 'text-amber-600', seconds: secs };
+  return { text: formatTTL(secs), color: 'text-emerald-600', seconds: secs };
 }

 export default function ShortLivedPage() {
@@ -75,8 +75,8 @@ export default function ShortLivedPage() {
      label: 'Certificate',
      render: (c) => (
        <div>
-          <div className="font-medium text-slate-200">{c.common_name}</div>
-          <div className="text-xs text-slate-500 mt-0.5">{c.id}</div>
+          <div className="font-medium text-ink">{c.common_name}</div>
+          <div className="text-xs text-ink-faint mt-0.5">{c.id}</div>
        </div>
      ),
    },
@@ -103,15 +103,15 @@ export default function ShortLivedPage() {
        const profile = profileMap.get(c.certificate_profile_id);
        return (
          <div>
-            <div className="text-sm text-slate-300">{profile?.name || c.certificate_profile_id || '—'}</div>
-            {profile && <div className="text-xs text-slate-500">Max TTL: {formatTTL(profile.max_ttl_seconds)}</div>}
+            <div className="text-sm text-ink">{profile?.name || c.certificate_profile_id || '—'}</div>
+            {profile && <div className="text-xs text-ink-faint">Max TTL: {formatTTL(profile.max_ttl_seconds)}</div>}
          </div>
        );
      },
    },
-    { key: 'env', label: 'Environment', render: (c) => <span className="text-slate-300">{c.environment || '—'}</span> },
-    { key: 'issuer', label: 'Issuer', render: (c) => <span className="text-slate-400 text-xs">{c.issuer_id}</span> },
-    { key: 'expires', label: 'Expires At', render: (c) => <span className="text-xs text-slate-400">{formatDateTime(c.expires_at)}</span> },
+    { key: 'env', label: 'Environment', render: (c) => <span className="text-ink">{c.environment || '—'}</span> },
+    { key: 'issuer', label: 'Issuer', render: (c) => <span className="text-ink-muted text-xs">{c.issuer_id}</span> },
+    { key: 'expires', label: 'Expires At', render: (c) => <span className="text-xs text-ink-muted">{formatDateTime(c.expires_at)}</span> },
  ];

  return (
@@ -121,21 +121,21 @@ export default function ShortLivedPage() {
        subtitle={`${shortLivedCerts.length} active ephemeral certificates`}
      />
      {/* Stats bar */}
-      <div className="px-6 py-3 flex gap-6 border-b border-slate-700/50">
+      <div className="px-6 py-3 flex gap-6 border-b border-surface-border/50">
        <div className="flex items-center gap-2">
-          <div className="w-2 h-2 rounded-full bg-emerald-400" />
-          <span className="text-xs text-slate-400">Active:</span>
-          <span className="text-xs font-medium text-emerald-400">{active}</span>
+          <div className="w-2 h-2 rounded-full bg-emerald-500" />
+          <span className="text-xs text-ink-muted">Active:</span>
+          <span className="text-xs font-medium text-emerald-600">{active}</span>
        </div>
        <div className="flex items-center gap-2">
-          <div className="w-2 h-2 rounded-full bg-red-400" />
-          <span className="text-xs text-slate-400">Expired:</span>
-          <span className="text-xs font-medium text-red-400">{expired}</span>
+          <div className="w-2 h-2 rounded-full bg-red-500" />
+          <span className="text-xs text-ink-muted">Expired:</span>
+          <span className="text-xs font-medium text-red-600">{expired}</span>
        </div>
        <div className="flex items-center gap-2">
-          <div className="w-2 h-2 rounded-full bg-blue-400" />
-          <span className="text-xs text-slate-400">Profiles:</span>
-          <span className="text-xs font-medium text-blue-400">{profiles.size}</span>
+          <div className="w-2 h-2 rounded-full bg-brand-400" />
+          <span className="text-xs text-ink-muted">Profiles:</span>
+          <span className="text-xs font-medium text-brand-400">{profiles.size}</span>
        </div>
      </div>
      <div className="flex-1 overflow-y-auto">
@@ -81,8 +81,8 @@ function CreateTargetWizard({ onClose, onSuccess }: { onClose: () => void; onSuc
  const canProceedToReview = name && targetType && fields.filter(f => f.required).every(f => config[f.key]);

  return (
-    <div className="fixed inset-0 bg-black/60 flex items-center justify-center z-50" onClick={onClose}>
-      <div className="bg-slate-800 border border-slate-600 rounded-xl p-6 w-full max-w-lg shadow-2xl" onClick={e => e.stopPropagation()}>
+    <div className="fixed inset-0 bg-black/40 flex items-center justify-center z-50" onClick={onClose}>
+      <div className="bg-surface border border-surface-border rounded p-5 w-full max-w-lg shadow-xl" onClick={e => e.stopPropagation()}>
        {/* Step indicators */}
        <div className="flex items-center gap-3 mb-6">
          {['Select Type', 'Configure', 'Review'].map((label, i) => {
@@ -93,36 +93,36 @@ function CreateTargetWizard({ onClose, onSuccess }: { onClose: () => void; onSuc
            return (
              <div key={label} className="flex items-center gap-2">
                <div className={`w-6 h-6 rounded-full flex items-center justify-center text-xs font-medium ${
-                  isDone ? 'bg-emerald-500 text-white' : isActive ? 'bg-blue-500 text-white' : 'bg-slate-700 text-slate-400'
+                  isDone ? 'bg-emerald-600 text-white' : isActive ? 'bg-brand-400 text-white' : 'bg-surface-border text-ink-muted'
                }`}>
                  {isDone ? '✓' : i + 1}
                </div>
-                <span className={`text-xs ${isActive ? 'text-slate-200' : 'text-slate-500'}`}>{label}</span>
-                {i < 2 && <div className="w-8 h-px bg-slate-700" />}
+                <span className={`text-xs ${isActive ? 'text-ink' : 'text-ink-faint'}`}>{label}</span>
+                {i < 2 && <div className="w-8 h-px bg-surface-border" />}
              </div>
            );
          })}
        </div>

-        {error && <div className="bg-red-500/10 border border-red-500/20 text-red-400 rounded-lg px-3 py-2 text-sm mb-4">{error}</div>}
+        {error && <div className="bg-red-50 border border-red-200 text-red-700 rounded px-3 py-2 text-sm mb-4">{error}</div>}

        {/* Step 1: Select Type */}
        {step === 'type' && (
          <div>
-            <h2 className="text-lg font-semibold text-slate-200 mb-4">Select Target Type</h2>
+            <h2 className="text-lg font-semibold text-ink mb-4">Select Target Type</h2>
            <div className="space-y-2">
              {TARGET_TYPES.map(t => (
                <button
                  key={t.value}
                  onClick={() => { setTargetType(t.value); setConfig({}); }}
-                  className={`w-full text-left px-4 py-3 rounded-lg border transition-colors ${
+                  className={`w-full text-left px-4 py-3 rounded border transition-colors ${
                    targetType === t.value
-                      ? 'border-blue-500 bg-blue-500/10'
-                      : 'border-slate-600 hover:border-slate-500 bg-slate-900'
+                      ? 'border-brand-400 bg-brand-50'
+                      : 'border-surface-border hover:border-surface-border bg-white'
                  }`}
                >
-                  <div className="text-sm font-medium text-slate-200">{t.label}</div>
-                  <div className="text-xs text-slate-400 mt-0.5">{t.description}</div>
+                  <div className="text-sm font-medium text-ink">{t.label}</div>
+                  <div className="text-xs text-ink-muted mt-0.5">{t.description}</div>
                </button>
              ))}
            </div>
@@ -137,35 +137,35 @@ function CreateTargetWizard({ onClose, onSuccess }: { onClose: () => void; onSuc
        {/* Step 2: Configure */}
        {step === 'config' && (
          <div>
-            <h2 className="text-lg font-semibold text-slate-200 mb-4">
+            <h2 className="text-lg font-semibold text-ink mb-4">
              Configure {typeLabels[targetType] || targetType} Target
            </h2>
            <div className="space-y-3">
              <div>
-                <label className="text-xs text-slate-400 block mb-1">Target Name *</label>
+                <label className="text-xs text-ink-muted block mb-1">Target Name *</label>
                <input value={name} onChange={e => setName(e.target.value)}
-                  className="w-full bg-slate-900 border border-slate-600 rounded-lg px-3 py-2 text-sm text-slate-200 focus:outline-none focus:border-blue-500"
+                  className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink focus:outline-none focus:border-brand-400"
                  placeholder="web-server-1" />
              </div>
              <div className="grid grid-cols-2 gap-3">
                <div>
-                  <label className="text-xs text-slate-400 block mb-1">Hostname</label>
+                  <label className="text-xs text-ink-muted block mb-1">Hostname</label>
                  <input value={hostname} onChange={e => setHostname(e.target.value)}
-                    className="w-full bg-slate-900 border border-slate-600 rounded-lg px-3 py-2 text-sm text-slate-200 focus:outline-none focus:border-blue-500"
+                    className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink focus:outline-none focus:border-brand-400"
                    placeholder="web1.example.com" />
                </div>
                <div>
-                  <label className="text-xs text-slate-400 block mb-1">Agent ID</label>
+                  <label className="text-xs text-ink-muted block mb-1">Agent ID</label>
                  <input value={agentId} onChange={e => setAgentId(e.target.value)}
-                    className="w-full bg-slate-900 border border-slate-600 rounded-lg px-3 py-2 text-sm text-slate-200 focus:outline-none focus:border-blue-500"
+                    className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink focus:outline-none focus:border-brand-400"
                    placeholder="agent-web1" />
                </div>
              </div>
              {fields.map(f => (
                <div key={f.key}>
-                  <label className="text-xs text-slate-400 block mb-1">{f.label} {f.required ? '*' : ''}</label>
+                  <label className="text-xs text-ink-muted block mb-1">{f.label} {f.required ? '*' : ''}</label>
                  <input value={config[f.key] || ''} onChange={e => setConfig(c => ({ ...c, [f.key]: e.target.value }))}
-                    className="w-full bg-slate-900 border border-slate-600 rounded-lg px-3 py-2 text-sm text-slate-200 focus:outline-none focus:border-blue-500"
+                    className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink focus:outline-none focus:border-brand-400"
                    placeholder={f.placeholder} />
                </div>
              ))}
@@ -184,32 +184,32 @@ function CreateTargetWizard({ onClose, onSuccess }: { onClose: () => void; onSuc
        {/* Step 3: Review */}
        {step === 'review' && (
          <div>
-            <h2 className="text-lg font-semibold text-slate-200 mb-4">Review Target</h2>
-            <div className="bg-slate-900 rounded-lg p-4 space-y-2 text-sm">
+            <h2 className="text-lg font-semibold text-ink mb-4">Review Target</h2>
+            <div className="bg-page rounded p-4 space-y-2 text-sm">
              <div className="flex justify-between">
-                <span className="text-slate-400">Name</span>
-                <span className="text-slate-200">{name}</span>
+                <span className="text-ink-muted">Name</span>
+                <span className="text-ink">{name}</span>
              </div>
              <div className="flex justify-between">
-                <span className="text-slate-400">Type</span>
-                <span className="text-slate-200">{typeLabels[targetType] || targetType}</span>
+                <span className="text-ink-muted">Type</span>
+                <span className="text-ink">{typeLabels[targetType] || targetType}</span>
              </div>
              {hostname && (
                <div className="flex justify-between">
-                  <span className="text-slate-400">Hostname</span>
-                  <span className="text-slate-200 font-mono text-xs">{hostname}</span>
+                  <span className="text-ink-muted">Hostname</span>
+                  <span className="text-ink font-mono text-xs">{hostname}</span>
                </div>
              )}
              {agentId && (
                <div className="flex justify-between">
-                  <span className="text-slate-400">Agent</span>
-                  <span className="text-slate-200 font-mono text-xs">{agentId}</span>
+                  <span className="text-ink-muted">Agent</span>
+                  <span className="text-ink font-mono text-xs">{agentId}</span>
                </div>
              )}
              {Object.entries(config).filter(([, v]) => v).map(([k, v]) => (
                <div key={k} className="flex justify-between">
-                  <span className="text-slate-400">{k.replace(/_/g, ' ')}</span>
-                  <span className="text-slate-200 font-mono text-xs truncate max-w-xs">{v}</span>
+                  <span className="text-ink-muted">{k.replace(/_/g, ' ')}</span>
+                  <span className="text-ink font-mono text-xs truncate max-w-xs">{v}</span>
                </div>
              ))}
            </div>
@@ -250,8 +250,8 @@ export default function TargetsPage() {
      label: 'Target',
      render: (t) => (
        <div>
-          <div className="font-medium text-slate-200">{t.name}</div>
-          <div className="text-xs text-slate-500 font-mono">{t.id}</div>
+          <div className="font-medium text-ink">{t.name}</div>
+          <div className="text-xs text-ink-faint font-mono">{t.id}</div>
        </div>
      ),
    },
@@ -265,12 +265,12 @@ export default function TargetsPage() {
    {
      key: 'hostname',
      label: 'Hostname',
-      render: (t) => <span className="text-slate-300 font-mono text-xs">{t.hostname || '\u2014'}</span>,
+      render: (t) => <span className="text-ink font-mono text-xs">{t.hostname || '\u2014'}</span>,
    },
    {
      key: 'agent',
      label: 'Agent',
-      render: (t) => <span className="text-xs text-slate-400 font-mono">{t.agent_id || '\u2014'}</span>,
+      render: (t) => <span className="text-xs text-ink-muted font-mono">{t.agent_id || '\u2014'}</span>,
    },
    {
      key: 'status',
@@ -280,7 +280,7 @@ export default function TargetsPage() {
    {
      key: 'created',
      label: 'Created',
-      render: (t) => <span className="text-xs text-slate-400">{formatDateTime(t.created_at)}</span>,
+      render: (t) => <span className="text-xs text-ink-muted">{formatDateTime(t.created_at)}</span>,
    },
    {
      key: 'actions',
@@ -288,7 +288,7 @@ export default function TargetsPage() {
      render: (t) => (
        <button
          onClick={(e) => { e.stopPropagation(); if (confirm(`Delete target ${t.name}?`)) deleteMutation.mutate(t.id); }}
-          className="text-xs text-red-400 hover:text-red-300 transition-colors"
+          className="text-xs text-red-600 hover:text-red-700 transition-colors"
        >
          Delete
        </button>
@@ -27,8 +27,8 @@ export default function TeamsPage() {
      label: 'Team',
      render: (t) => (
        <div>
-          <div className="font-medium text-slate-200">{t.name}</div>
-          <div className="text-xs text-slate-500 font-mono">{t.id}</div>
+          <div className="font-medium text-ink">{t.name}</div>
+          <div className="text-xs text-ink-faint font-mono">{t.id}</div>
        </div>
      ),
    },
@@ -36,13 +36,13 @@ export default function TeamsPage() {
      key: 'description',
      label: 'Description',
      render: (t) => (
-        <span className="text-slate-300 text-sm max-w-sm truncate block">{t.description || '\u2014'}</span>
+        <span className="text-ink text-sm max-w-sm truncate block">{t.description || '\u2014'}</span>
      ),
    },
    {
      key: 'created',
      label: 'Created',
-      render: (t) => <span className="text-xs text-slate-400">{formatDateTime(t.created_at)}</span>,
+      render: (t) => <span className="text-xs text-ink-muted">{formatDateTime(t.created_at)}</span>,
    },
    {
      key: 'actions',
@@ -50,7 +50,7 @@ export default function TeamsPage() {
      render: (t) => (
        <button
          onClick={(e) => { e.stopPropagation(); if (confirm(`Delete team ${t.name}?`)) deleteMutation.mutate(t.id); }}
-          className="text-xs text-red-400 hover:text-red-300 transition-colors"
+          className="text-xs text-red-600 hover:text-red-700 transition-colors"
        >
          Delete
        </button>
@@ -6,7 +6,59 @@ module.exports = {
  ],
  darkMode: 'class',
  theme: {
-    extend: {},
+    extend: {
+      colors: {
+        // === certctl brand palette (from logo) ===
+        brand: {
+          50:  '#eefbf6',
+          100: '#d5f5e9',
+          200: '#afe9d5',
+          300: '#7ad8bc',
+          400: '#2ea88f', // Primary teal — logo "ctl"
+          500: '#1f9680',
+          600: '#147868',
+          700: '#106055',
+          800: '#0f4d44',
+          900: '#0d3f39',
+        },
+        accent: {
+          blue:   '#3b7dd8', // Logo blue arrows
+          orange: '#e8873a', // Logo orange arrows
+          green:  '#4ebe6e', // Logo green highlights
+        },
+        // Light content area
+        page:    '#f0f4f8',  // Light blue-gray page background
+        surface: {
+          DEFAULT: '#ffffff', // Cards — white
+          hover:   '#f8fafc', // Hover on cards
+          border:  '#e2e8f0', // Card/table borders
+          muted:   '#f1f5f9', // Zebra stripes, subtle fills
+        },
+        // Dark sidebar
+        sidebar: {
+          DEFAULT: '#0c2e25', // Deep teal-black
+          hover:   '#134438',
+          active:  '#185c4a',
+          border:  '#1a5c48',
+          text:    '#94d2be', // Muted teal for inactive nav
+        },
+        // Text on light backgrounds
+        ink: {
+          DEFAULT: '#1e293b', // Primary text
+          muted:   '#64748b', // Secondary text
+          faint:   '#94a3b8', // Tertiary/placeholder
+        },
+      },
+      fontFamily: {
+        mono: ['JetBrains Mono', 'ui-monospace', 'SFMono-Regular', 'Menlo', 'Monaco', 'Consolas', 'monospace'],
+      },
+      borderRadius: {
+        DEFAULT: '0.375rem',
+        sm: '0.25rem',
+        md: '0.5rem',
+        lg: '0.75rem',
+      },
+    },
  },
  plugins: [],
 }
Author	SHA1	Message	Date
shankar0123	03593d4304	feat: wire ACME EAB into account registration + ZeroSSL auto-fetch EAB credentials (KID + HMAC) were defined in the ACME connector config but never wired into the acme.Account registration call. This fixes the dead code and adds automatic EAB credential fetching for ZeroSSL — when the directory URL is detected as ZeroSSL and no EAB credentials are provided, certctl calls ZeroSSL's public API to get them automatically. Changes: - Wire EABKid/EABHmac into acme.Account.ExternalAccountBinding - Add isZeroSSL() detection and fetchZeroSSLEAB() auto-fetch - Add CERTCTL_ACME_EAB_KID/CERTCTL_ACME_EAB_HMAC env vars to main.go - Add 13 ACME connector tests (config validation, EAB decode, ZeroSSL auto-EAB with mock servers, URL detection) - Update docs: README, architecture, connectors, demo-advanced, testing-guide with EAB/auto-EAB documentation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-27 15:34:48 -04:00
shankar0123	87355c3efb	docs: add table of contents to all major documentation files Navigation menus for testing guide, architecture, concepts, connectors, quickstart, advanced demo, and three compliance docs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-26 23:38:28 -04:00
shankar0123	f92d148881	chore: bump version badge to v2.0.3 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-26 23:29:33 -04:00
shankar0123	50c520e1ff	feat: dashboard theme overhaul — light content area with branded teal sidebar Complete frontend visual redesign using certctl logo color palette: - Deep teal sidebar (#0c2e25) with prominent centered logo (64px in white pill) - Light content area (#f0f4f8) with white cards and visible borders - Brand colors from logo: teal (#2ea88f), blue (#3b7dd8), orange (#e8873a), green (#4ebe6e) - Inter + JetBrains Mono typography, colored stat card top borders - All 17 pages + 7 components updated (25 files, ~700 lines changed) - 15 new dashboard screenshots replacing old dark theme screenshots - Prometheus metrics e2e test added, integration test mock fixes - Docs updated: architecture.md theme description, testing-guide.md DNS-PERSIST-01 coverage Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-26 23:27:42 -04:00
shankar0123	8380cb7946	docs: remove stats tagline from README header Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-26 14:29:56 -04:00