Follow-up from the S10 (adopt-node) review. AdoptNode/registerAdoptedNode registers the node with empty AdminCert/AdminKey, so admin-mTLS operations (including DecommissionNode) fail until the operator separately runs LINK enrollment to provision managed credentials. This matches the plan (managed creds deferred to the LINK path), but there is no state/marker signalling "adopted, pending link", so the gap is invisible in the UI.
Add a pending-link (or similar) node state surfaced in the web after adoption, and either guide the operator into LINK enrollment or auto-chain it. Non-blocking for v1.0.0 adopt (the node is provisioned + running its CA after ceremony); it is the managed-by-fleet step that is deferred.
Part of #24.
Follow-up from the S10 (adopt-node) review.
AdoptNode/registerAdoptedNoderegisters the node with empty AdminCert/AdminKey, so admin-mTLS operations (including DecommissionNode) fail until the operator separately runs LINK enrollment to provision managed credentials. This matches the plan (managed creds deferred to the LINK path), but there is no state/marker signalling "adopted, pending link", so the gap is invisible in the UI.Add a
pending-link(or similar) node state surfaced in the web after adoption, and either guide the operator into LINK enrollment or auto-chain it. Non-blocking for v1.0.0 adopt (the node is provisioned + running its CA after ceremony); it is the managed-by-fleet step that is deferred.Part of #24.