From 4d7287c005e963eb55aabc246a3a8bc5b344aba1 Mon Sep 17 00:00:00 2001
From: reachableceo <charles@turnsys.com>
Date: Fri, 4 Sep 2026 17:31:52 -0500
Subject: [PATCH] =?UTF-8?q?docs(questions):=20v11=20=E2=80=94=20ACME=20DNS?=
 =?UTF-8?q?-01=20TSIG=20+=20step-ca=20go;=20legacy-*=20exempt=20[#697][#77?=
 =?UTF-8?q?1]?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://projects.knownelement.com/issues/697
---
 Makefile         |  2 +-
 questions-v11.md | 17 +++++++++++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 questions-v11.md

diff --git a/Makefile b/Makefile
index 4e52dad..9ac9912 100644
--- a/Makefile
+++ b/Makefile
@@ -7,7 +7,7 @@
 # they don't need this file.
 
 # Project-specific overrides for check-rules.sh
-export PROJECT_DOC_EXEMPT ?= AGENTS.md STATUS.md WORKING.md README.md ADOPTING.md LICENSE .env.example questions-v1.md BASELINE-PROMPT.md PATTERNS.md
+export PROJECT_DOC_EXEMPT ?= legacy-* AGENTS.md STATUS.md WORKING.md README.md ADOPTING.md LICENSE .env.example questions-v1.md BASELINE-PROMPT.md PATTERNS.md
 export PROJECT_DISCOURSE_HOST ?= community.turnsys.com
 
 .PHONY: setup validate fast lint test garden up down status clean help
diff --git a/questions-v11.md b/questions-v11.md
new file mode 100644
index 0000000..9f8953a
--- /dev/null
+++ b/questions-v11.md
@@ -0,0 +1,17 @@
+# Questions — v11 (current round)
+
+New round opened by the 09-04 night grind (monitoring wiring t/335 EXECUTED;
+apt-satellite lane LIVE; CA/ACME pilot done). Two gating questions for the
+next phase. One-line answers fine. (v10 + history: archive/questions/)
+
+## CA/ACME phase B (t/327 design)
+
+**Q1 (DNS-01 for the fleet ACME).** The prod ACME endpoint on tsys-ca (phase
+B) needs to validate knel.net identifiers. Recommended: **DNS-01 via
+Technitium** — may I generate a TSIG key scoped to `_acme-challenge.*`
+updates and load it on tsys-dns (one config edit + git SoR sync), or prefer
+HTTP-01 only for now?
+
+**Q2 (step-ca go on tsys-ca).** Deploy the prod ACME container on the tsys-ca
+VM (new container, intermediate signed by the existing fleet root, bound to
+the Tailscale IP :8443) — approve to start, or pick a window?