From 6e48f6b44a97b4e638a7d7321e1ec247fa740958 Mon Sep 17 00:00:00 2001 From: Rehan Khan Date: Mon, 24 Aug 2026 00:39:35 +0500 Subject: [PATCH] docs: fix collector README implementation status --- collector/README.md | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/collector/README.md b/collector/README.md index d123d40..5c4e1ae 100644 --- a/collector/README.md +++ b/collector/README.md @@ -2,15 +2,22 @@ mTLS ingest service that receives CSI data from sensor nodes. -Status: collector-side mTLS ingest, certificate-CN allow-listing, CRL-based -revocation, SIGHUP reload of the allow-list and CRL, payload validation, and -in-memory anti-replay checks, and the signed forensic handoff are implemented and -tested. Configure `VESTRIX_FORENSICS_PRIVATE_KEY` with an unencrypted Ed25519 PKCS#8 +Status: collector-side mTLS ingest, exact certificate-CN allow-listing, +leaf-certificate CRL checks, payload validation, per-process in-memory sequence +counters that reject replayed or out-of-order events, and the fail-closed signed +forensic handoff are implemented and tested. On supported POSIX platforms, SIGHUP +reloads the allow-list and CRL-backed TLS context for new connections without a +restart; it does not terminate connections already accepted. Replay state is not +durable or shared between collector processes and resets on restart. + +Configure `VESTRIX_FORENSICS_PRIVATE_KEY` with an unencrypted Ed25519 PKCS#8 private-key path and, optionally, `VESTRIX_FORENSICS_STORE` with the JSONL path. Accepted events are acknowledged only after a durable signed append; append failure -rejects the event. Rejected ingest attempts remain structured collector decision -logs and are not appended to the signed chain. `certs/check_expiry.sh` flags node -certificates nearing expiry (30 days by default). +rejects the event. Composition tests cover an mTLS-accepted event through a +verifiable signed append, replay and revoked-certificate rejection without a chain +append, and append-failure rejection. Rejected ingest attempts remain structured +collector decision logs and are not appended to the signed chain. +`certs/check_expiry.sh` flags node certificates nearing expiry (30 days by default). Revoke a certificate issued by the current CA tooling with `bash certs/revoke_node.sh `, distribute the regenerated `ca.crl` to the