v1.0.0: mTLS — certificate-based mutual authentication (encryption already done)

[MicBur]

Roadmap: v1.0.0

Transport encryption already exists (src/common/tls_util.{h,cpp}, C2): opt-in SUCO_TLS=1, wired through client/coordinator/worker/wrapper, self-signed cert + SSL_read/SSL_write. Today peer authentication is the HMAC challenge-response and TLS verification is disabled. This item adds the mutual-TLS layer for zero-trust enterprise use.

Scope

• Certificate provisioning/distribution (CA + per-node certs; a suco subcommand or script)
• Enable peer verification on both wrap_accept and wrap_connect (currently verification-disabled)
• Mutual auth: client presents a cert; coordinator/worker verify against the CA
• Keep HMAC as fallback / defense-in-depth; document the trust model
• Opt-in, backward compatible (plaintext + HMAC path unchanged when off)

Lane: Linux/grid (Claude); builds on existing tls_util.