Security

The cryptographic backbone:

• Threat model — what we defend against, and what's out of scope.
• mTLS and signed actions — how the agent authenticates to the gateway, and how actions get signed.
• Asynq task signing — HMAC envelope on every queued task between control and gateway.
• Remote terminal access — operator → device shell, audit-logged.
• Audit log — what gets recorded, and how to read it.
• CA rotation — the deploy-time procedure for swapping the root CA.
• Two-factor authentication — TOTP setup, backup codes, and the admin reset path.