TLS on every transport, cap-gated mail, real-time SIEM

The data-confidentiality track is complete: all five network transports now do TLS. A reusable TLS client underlies SMTP (TLS and STARTTLS), NATS honours tls_required, Redis speaks rediss://, MQTT on 8883, and gRPC over grpcs:// with ALPN h2 was the last plaintext transport to close. One shared policy is applied at every mbedTLS config site, server and client: a TLS 1.2/1.3 floor that is asserted rather than inherited, and an explicit ECDHE-AEAD-only ciphersuite pin, so static RSA, RC4, 3DES and CBC-SHA1 are dropped by omission and forward secrecy is guaranteed.

The Linux release binary is now built inside a pinned Debian trixie image against mbedTLS 3.x, so it negotiates TLS 1.3, and the TLS 1.2 configuration is recorded against the Dutch government's Forum Standaardisatie / NCSC guidance. Mail is reachable from Kern for the first time: net_smtp_send_mail is cap-gated on Cap<Net>, fails closed on a non-TLS channel, CR/LF-guards every address, dot-stuffs the payload, and batches many messages over one authenticated connection, with egress control and SIEM security monitoring on the mail path. net.siem_sink ships each SecurityEvent the moment it happens: CEF over syslog/UDP for ArcSight, QRadar, Splunk and Wazuh, or JSON over HTTPS for Splunk HEC, Elastic and Sentinel, fire-and-forget with no in-memory retention.

Fleet-driven fixes landed alongside: the Postgres pool self-heals after a server restart, net.health readiness aggregation names which dependency is down, kctl gives daemonless day-2 container ops (ls, logs, exec, stats), and a communication-protocol security audit (about 75 findings across SSH, TLS, HTTP, WebSocket, messaging, DB and DNS) is landing in batches, each box-verified against real servers: the P0 stack buffer overflow in the MQTT packet builders (CWE-787); SSH host-key verification that fails closed on a changed key and refuses unknown hosts unless KERN_SSH_TOFU=1, plus a bounded connect timeout and keepalive floor under every TCP client; a Postgres sslmode look-alike-host bypass closed with exact loopback matching and verify-full when a CA root is configured, and savepoint names validated against SQL injection; a shared CR/LF field guard that stops NATS subject frame injection, an opt-in SSRF and DNS-rebinding guard screening the resolved address at every TCP connect (cloud-metadata and link-local first, strict adds RFC1918, CGNAT and ULA), WebSocket Origin and frame-length guards, HTTP request-line CR/LF rejection, NTP anti-spoofing, real HMAC sessions with constant-time verify, credential auth for NATS/MQTT/Redis that fails closed over TLS, and certificate pinning (KERN_TLS_PINS, SHA-256 of the peer DER, checked in the one shared handshake so every mbedTLS transport gets it).

The remaining P2/P3 list is cleared and box-verified; the one item briefly recorded as open (MQTT-over-TLS receive) was root-caused to a buggy verification test and is marked fixed, which is how the register works: findings are named, not hidden, and corrected when wrong.