cowork 4ac8f89def Bundle P.2-extended CI follow-up: rephrase aspirational env-var references to fix G-3 guard ...

CI's G-3 env-var docs drift guard caught four aspirational env vars
referenced in the Bundle P.2-extended RFC test-vector subsections that
aren't actually defined in internal/config/config.go:

  - CERTCTL_EST_KEYGEN_MODE       -> typo for CERTCTL_KEYGEN_MODE (corrected)
  - CERTCTL_OCSP_DELEGATED_RESPONDER_CERT_PATH -> not implemented (rephrased
    as forward-looking; v2 only supports byName ResponderID)
  - CERTCTL_CRL_VALIDITY_DURATION -> not implemented (rephrased; v2 has
    a hard-coded 7-day validity)
  - CERTCTL_CRL_PARTITIONED       -> not implemented (rephrased; v2 emits
    full CRLs only with no IDP extension)

The byKey ResponderID, partitioned-CRL IDP, and configurable CRL
validity test vectors remain documented but are now framed as 'becomes
a positive test once <feature> support lands' rather than as currently-
implemented configuration. Same applies to the OCSP delegated-responder
mode test vector.

This keeps the RFC conformance documentation intact while staying
honest about what's actually wired up in v2.

CI guard verification (locally simulated):
  G-3 env-var docs drift guard: CLEAN

Bundle: P.2-extended-ci-fix

2026-04-27 19:16:19 +00:00

..

screenshots

fix(security): TICKET-009 add HTTP timeouts to notifier clients

2026-03-27 21:33:31 -04:00

architecture.md

Bundle D: Documentation & transparency sweep — 8 findings closed

2026-04-27 00:47:15 +00:00

certctl-for-cert-manager-users.md

v2.0.47: HTTPS Everywhere — TLS-only control plane, agents/CLI/MCP

2026-04-20 03:43:10 +00:00

compliance-nist.md

Unify API auth + RFC-compliant CRL/OCSP (M-002 + M-003 + M-006, auto-closes M-001)

2026-04-18 18:17:41 +00:00

compliance-pci-dss.md

v2.0.47: HTTPS Everywhere — TLS-only control plane, agents/CLI/MCP

2026-04-20 03:43:10 +00:00

compliance-soc2.md

docs: reconcile scheduler topology across sibling docs (7 → 12 loops)

2026-04-20 02:51:34 +00:00

compliance.md

fix(bundle-6): Audit Integrity + Privacy — 3 audit findings closed

2026-04-26 00:26:44 +00:00

concepts.md

Close I-004 (agent hard-delete cascades targets) coverage-gap finding

2026-04-19 05:24:00 +00:00

connectors.md

fix(deploy,helm,docs): published-image HEALTHCHECK speaks HTTPS + Helm /ready path + docs HTTPS sweep (U-2)

2026-04-25 12:02:18 +00:00

database-tls.md

Bundle B: Auth & transport surface tightening — 5 findings closed

2026-04-26 23:09:10 +00:00

demo-advanced.md

v2.0.47: HTTPS Everywhere — TLS-only control plane, agents/CLI/MCP

2026-04-20 03:43:10 +00:00

examples.md

docs(README,features,examples): replace stale source counts with rebuild commands (S-1 master)

2026-04-25 16:26:44 +00:00

features.md

Bundle B CI follow-up: G-3 env-var docs + M-028 closure (final 5 SA1019 sites)

2026-04-26 23:35:13 +00:00

legacy-est-scep.md

Bundle F follow-up: M-023 doc env-var cleanup (G-3 guard fix)

2026-04-27 01:55:04 +00:00

mcp.md

v2.0.47: HTTPS Everywhere — TLS-only control plane, agents/CLI/MCP

2026-04-20 03:43:10 +00:00

migrate-from-acmesh.md

v2.0.47: HTTPS Everywhere — TLS-only control plane, agents/CLI/MCP

2026-04-20 03:43:10 +00:00

migrate-from-certbot.md

v2.0.47: HTTPS Everywhere — TLS-only control plane, agents/CLI/MCP

2026-04-20 03:43:10 +00:00

openapi.md

v2.0.47: HTTPS Everywhere — TLS-only control plane, agents/CLI/MCP

2026-04-20 03:43:10 +00:00

qa-test-guide.md

Bundle Q (Coverage Audit Closure): property-based pilot + hygiene — L-001/L-002/L-003/L-004/I-001 closed

2026-04-27 18:36:47 +00:00

quickstart.md

fix(db): emit volume-state guidance on postgres auth failure (U-1, #10)

2026-04-24 23:21:26 +00:00

security.md

Bundle G: Final audit closure — L-004 + D-003/4/5/7 closed; 54/55 + 7/7

2026-04-27 02:27:44 +00:00

test-env.md

v2.0.48: swap self-signed TLS bootstrap algorithm ed25519 → ECDSA-P256

2026-04-20 04:17:05 +00:00

testing-guide.md

Bundle P.2-extended CI follow-up: rephrase aspirational env-var references to fix G-3 guard

2026-04-27 19:16:19 +00:00

testing-strategy.md

Bundle G: Final audit closure — L-004 + D-003/4/5/7 closed; 54/55 + 7/7

2026-04-27 02:27:44 +00:00

tls.md

Bundle D: Documentation & transparency sweep — 8 findings closed

2026-04-27 00:47:15 +00:00

upgrade-to-tls.md

v2.0.48: swap self-signed TLS bootstrap algorithm ed25519 → ECDSA-P256

2026-04-20 04:17:05 +00:00

upgrade-to-v2-jwt-removal.md

fix(security,config): remove unimplemented JWT auth-type, close silent downgrade (G-1)

2026-04-25 00:22:23 +00:00

why-certctl.md

Update LICENSE metadata

2026-04-26 23:29:59 +00:00