Compatibility
Which released components the current core works with, measured rather than maintained by hand.
The gateways and the host agent are separate repositories and release on their own schedule. Any of them can release on a Tuesday and break a core that has not changed, and no pull request here would ever run — so this page is produced by starting each one and talking to it, rather than by remembering.
Gateways
Produced by starting each gateway and talking to it: first with the conformance probe from the gateway SDK, then with a core built from this repository dialling it over mutual TLS.
| Gateway | Version | Contract | Issuance | Core | Probe, all checks |
|---|---|---|---|---|---|
certpilot-gateway-selfsigned | v0.3.0 | pass | pass | pass | 6 passed, 0 failed, 3 skipped, 0 advisory |
certpilot-gateway-acme | v0.3.0 | pass | not exercised | pass | 4 passed, 2 failed, 1 skipped, 1 advisory |
certpilot-gateway-vault | v0.3.0 | pass | not exercised | pass | 4 passed, 2 failed, 2 skipped, 0 advisory |
Contract is every check in cmd/conformance from certpilot-gateway-sdk except issuance, run at v0.4.0 — the version this core builds against, rather than the newest, because the question is whether this pair works.
Issuance is separate because only the self-signed gateway can issue with nothing configured behind it; it is its own CA. The ACME gateway reaches a real CA and is refused for example.com by policy, and the Vault gateway is asked to issue with no Vault address and correctly refuses. Both of those are the gateway behaving properly, so they are recorded as not exercised rather than counted as failures. Exercising them needs a CA target this job does not have.
Core is a core built from this repository, configured with that gateway and mutual TLS, reporting whether it reached it and read its capabilities back.
The last column is the probe's own totals across every check including issuance, so a row can read "contract: pass" beside a non-zero failure count. That is the distinction above, not a contradiction.
Generated 2026-09-26 from core 52edefc.
The host agent
Whether this core still completes the whole agent lifecycle — enrol, grant, request, install, report — against a released agent. The last column is the check that cannot be satisfied by two systems that are merely both working: the SHA-256 the core recorded against the SHA-256 of the file actually on the host.
| Agent | Version | Lifecycle | Detail |
|---|---|---|---|
certpilot-agent | latest | pass | enrolled, requested, installed; the core's fingerprint matches the file on disk |
Generated 2026-09-26 from core 52edefc.