[eniac111]

Agent certificates:

• The agent checks its certificate every 12 hours, not only at start, and renews it 30 days before expiry.
• The policy port closes agent connections after at most 24 hours, so a renewed certificate is taken into use and an expired one cannot keep an old connection.
• Renewal keeps the presented certificate valid until the node first opens a policy stream with the new one, then revokes it (reason "superseded by renewal"). A renewal retried with the previous certificate revokes the unused one; any older certificate is refused. Renewal no longer deletes the node's revocation records.
• Revoking or decommissioning a node revokes its current and previous certificates.
• Open policy streams re-check revocation and expiry every minute.
• New migration 000048 adds nodes.previous_cert_serial.

Enrollment:

• Enroll, KerberosEnroll and CreateEnrollmentToken are rate limited per client IP (BOR_ENROLL_RATE_LIMIT, default 60 per minute, 0 disables). The limiter moves to internal/ratelimit and is shared with the HTTP auth routes.
• Kerberos enrollment refuses principals outside kerberos.realm (when set) and accepts only machine accounts (host/, $). The node name must belong to the principal.

Audit:

• Forwarding headers (X-Forwarded-For, X-Real-IP) are believed only from BOR_TRUSTED_PROXIES / audit.trusted_proxies; X-Forwarded-For is walked from the right, skipping trusted hops.
• BOR_AUDIT_ANONYMIZE_IPS now also applies to sign-in and sign-out.
• bor-server --reset-mfa writes auth.mfa.reset audit records and refuses to reset MFA when it cannot write them.

Other:

• CSRF and metrics bearer tokens are compared in constant time.
• The agent resets its reconnect backoff after a stream that stayed up for at least a minute.

BREAKING CHANGE: a Kerberos-enrolled agent whose agent.client_id does not match its machine principal is now refused.