Summary
The consolidated live-validation pass owed before cutting v1.0.0.
Scope
- CA hardening on ESXi: KMS state-key, CA key escrow (export -> import on a 2nd node), and subordinate re-key were shipped unit-tested only — validate each live on ESXi.
- FM on real nodes: the Fleet Manager + mTLS client-cert auth has only run against the local QEMU fm-live lab; exercise it against real ESXi CryptOS nodes.
- OS upgrade E2E: prove a Talos-style in-place image upgrade of an established node (config + CA identity persist, no re-ceremony). No upgrade path is built yet — needs its own design.
Runs last, after the enrollment + write-path slices land. Bare-metal is explicitly post-1.0 (v1.1).
Summary
The consolidated live-validation pass owed before cutting v1.0.0.
Scope
Runs last, after the enrollment + write-path slices land. Bare-metal is explicitly post-1.0 (v1.1).