wendy-certificates
Installation
SKILL.md
Wendy Certificates
How principals in the Wendy ecosystem get, renew, and lose certificates. pki-core is the sole issuer — every cert it mints binds a client-held key, never a bare identity claim. Which cert type a flow needs depends on where authorization will be enforced: a cloud-facing cert stays identity-only because cloud authorizes live against its own mutable state, while a device-facing cert must carry entitlements because the device has no live authority to consult when offline (§4.2). Full flow-level detail — including how the two credential shapes interact with the rest of the AAA contract — lives in the wendy-aaa-interop skill; this skill is the certificate-request/renewal/revocation slice of it.
Decision Table: Which Cert / Which Path
| Need | Path |
|---|---|
| Identity-only operator cert (steady-state login/session) | Direct pki-core endpoint — no cloud in this path |
| Entitlement-bearing cert (direct field/USB device access) | Operator-signed request + CSR → cloud attaches a grant → relayed to pki-core |
| Device cert (enrollment, first touch, recovery) | Enrollment flows — see the wendy-device-enrollment skill |
| Service account / machine user | Identical operator flow, through a different wendy-auth front door (§5.2, D17) |
(§5.2, D17)