Skip to content

docs: fix collector README implementation status #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dev-rehaann merged 1 commit into from
Aug 23, 2026
Merged

docs: fix collector README implementation status #8

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 14 additions & 7 deletions collector/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,15 +2,22 @@

mTLS ingest service that receives CSI data from sensor nodes.

Status: collector-side mTLS ingest, certificate-CN allow-listing, CRL-based
revocation, SIGHUP reload of the allow-list and CRL, payload validation, and
in-memory anti-replay checks, and the signed forensic handoff are implemented and
tested. Configure `VESTRIX_FORENSICS_PRIVATE_KEY` with an unencrypted Ed25519 PKCS#8
Status: collector-side mTLS ingest, exact certificate-CN allow-listing,
leaf-certificate CRL checks, payload validation, per-process in-memory sequence
counters that reject replayed or out-of-order events, and the fail-closed signed
forensic handoff are implemented and tested. On supported POSIX platforms, SIGHUP
reloads the allow-list and CRL-backed TLS context for new connections without a
restart; it does not terminate connections already accepted. Replay state is not
durable or shared between collector processes and resets on restart.

Configure `VESTRIX_FORENSICS_PRIVATE_KEY` with an unencrypted Ed25519 PKCS#8
private-key path and, optionally, `VESTRIX_FORENSICS_STORE` with the JSONL path.
Accepted events are acknowledged only after a durable signed append; append failure
rejects the event. Rejected ingest attempts remain structured collector decision
logs and are not appended to the signed chain. `certs/check_expiry.sh` flags node
certificates nearing expiry (30 days by default).
rejects the event. Composition tests cover an mTLS-accepted event through a
verifiable signed append, replay and revoked-certificate rejection without a chain
append, and append-failure rejection. Rejected ingest attempts remain structured
collector decision logs and are not appended to the signed chain.
`certs/check_expiry.sh` flags node certificates nearing expiry (30 days by default).

Revoke a certificate issued by the current CA tooling with
`bash certs/revoke_node.sh <node-id>`, distribute the regenerated `ca.crl` to the
Expand Down
Loading