Summary
Phase 1 (contract) of FM enrollment slice B (manager #21). Adds the wire surface the manager + web need:
- Node
cryptos.v1.NodeService: Attest(nonce) — the node signs a manager nonce with its CA identity key (challenge-response attestation). Response carries the signature + identity public key; ek_pub/ek_cert fields reserved for v1.1.
- Fleet
cryptos.fleet.v1.FleetService: CreateEnrollment / ApproveEnrollment / RejectEnrollment; extend EnrollmentRequest with kind (LINK|SUBORDINATE) + pinned_key_sha256.
MachineConfig.Management { manager_cn, trust_pem, operator_surface_readonly } — the LINK target that cryptos config carries through ApplyConfig.
Contract-only; engine + manager + web consume it in later phases. Design/plan: manager/plan/2026-07-15-fm-enrollment-slice-b-{design,plan}.md.
Summary
Phase 1 (contract) of FM enrollment slice B (manager #21). Adds the wire surface the manager + web need:
cryptos.v1.NodeService:Attest(nonce)— the node signs a manager nonce with its CA identity key (challenge-response attestation). Response carries the signature + identity public key;ek_pub/ek_certfields reserved for v1.1.cryptos.fleet.v1.FleetService:CreateEnrollment/ApproveEnrollment/RejectEnrollment; extendEnrollmentRequestwithkind(LINK|SUBORDINATE) +pinned_key_sha256.MachineConfig.Management { manager_cn, trust_pem, operator_surface_readonly }— the LINK target that cryptos config carries through ApplyConfig.Contract-only; engine + manager + web consume it in later phases. Design/plan: manager/plan/2026-07-15-fm-enrollment-slice-b-{design,plan}.md.