Ilker ManapandClaude Opus 5.5
179fdcdec5
The stateless overlay client (rollcall-overlay in the compute image) takes rollcall.tls= and rollcall.ca= like the agents: the CA is accepted only by its fingerprint and the overlay (munge.key and the like) comes over HTTPS, with no fallback. A deployed OS calls home over HTTPS when its rack serves it (it trusts the Rollcall CA from first boot). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>