Per-actor issuance profile in the inventory contract: optional `extensions`
allow-list (LocalCA -O clear + -O <ext>; Vault explicit extensions map) and
`max_ttl_hours` ceiling enforced against --ttl overrides. Actors without these
fields keep backend defaults.
agt-custodian: principal agt-custodian, 12h TTL/ceiling, permit-pty only (no
agent/port/X11 forwarding, no user-rc), no source-address (unstable
workstation egress). Ceremony routing lane agt-custodian-ssh-cert: supervisor
issues from the operator account; the agent cannot self-issue.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 605711@bnt-lap001
Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61
tegwick
e62763cba9