feat: add native Windows hierarchy test harness

2026-09-09 16:48:54 +00:00
parent 8985457d37
commit 409b64a2fb
30 changed files with 1033 additions and 44 deletions
@@ -39,6 +39,11 @@ use the defaults documented by the all-knob client reference.
 - The daemon prints its effective configuration after validation, with no
  command data or TLS material. Since v1 stores command/environment payloads in
  plaintext, configuration output is hygiene rather than a secrecy guarantee.
+- With an empty `tls.ca_file`, the client accepts a matching-host self-signed
+  server leaf. This provides TLS encryption and hostname routing only; v1 makes
+  no server-authentication or endpoint-ownership guarantee. Supplying a PEM CA
+  bundle restores normal CA-chain verification and is the preferred future
+  deployment model.

 ## Limits and cross-field validation