close client lifecycle plan — API was already fully implemented
Plan #3 at 95%. Initial audit was incorrect — the entire API surface was
already implemented and tested:
- POST /clients/enroll — age key pair generation, mesh IP validation,
attrs update, state → provisioning (impl.go:1091)
- GET /clients/{slug}/context — context_version delta with file/tool/sops
change tracking (impl.go:1195)
- GET /clients/{slug}/secrets — scoped secret key listing (impl.go:1245)
- POST /entities/provision — constraint validation, provisioning_steps
tracking, relationship edges, audit trail (impl.go:1271)
- GET /entities/{slug}/provision/status — step-by-step progress (impl.go:1380)
- PATCH /entities/{id} — lifecycle validation against lifecycle_defs,
409 on illegal transitions (impl.go:933)
- client_lifecycle_test.go: 324 lines, full e2e:
planned→enroll→provisioning→active→migrating→deprecated→failed
+ provision + relations + blast radius + rejection tests
Remaining (follow-up): bootstrap.sh + context-poller.sh thin-client scripts.
dtoro
efa66c7321