Nice work on the mTLS/gRPC push design — the inotify drift-catch on parent dirs is a clean answer to the "revert happens before the user notices" problem, and I like that the audit trail
is server-side.
Question on the policy model: how do you handle conflicting policies across sources — say a package postinstall rewrites a managed file while a newer policy is mid-sync from the server, or
two policy types touch the same file? Does the agent queue and reconcile revisions, or last-write-wins?
Also curious: with LDAP-only auth, how do non-domain single-user laptops fit in? I manage a few personal machines that I'd love to centralize but they aren't LDAP-joined — is there a
lightweight path, or is the temp-token enrollment strictly for domain boxes?
Also curious: with LDAP-only auth, how do non-domain single-user laptops fit in? I manage a few personal machines that I'd love to centralize but they aren't LDAP-joined — is there a lightweight path, or is the temp-token enrollment strictly for domain boxes?