Aegis
Aegis manages a gateway's TLS configuration through reviewed policy rollouts. Its executable catalog identifies algorithms actually linked into a specific release and distinguishes them from options available on a configured agent. The reference describes the signed v0.5.5 native Linux release; see exact build applicability.
What the catalog establishes
The gateway adapter uses rustls with AWS-LC. It lists TLS cipher suites, key-exchange groups, client-authentication prerequisites, and tested profiles. The primitive registry separately exposes typed DH, KEM, AEAD, signature, and hash operations. A primitive's presence does not imply TLS or Messenger support.
New implementations ship in releases. Policies select installed options; native external plugin binaries and WebAssembly plugin execution are unsupported. A complete TLS configuration is prepared before publication. Changes affect new handshakes, while existing connections retain their configuration.
Operate through review and observations
Axis saves drafts without changing live delivery. A review freezes the candidate, previous policy, exact targets, and capability fingerprints. Apply revalidates that review; fresh acknowledgments and attributed handshake observations govern canary progression. Rollback remains pending until affected agents acknowledge the previous configuration. Follow the policy walkthrough.
A TLS-terminating gateway necessarily handles plaintext and its configured TLS identity in the customer's runtime. This catalog does not claim plaintext is absent from the gateway, that certificate authentication is post-quantum, or that QUIC and every mesh adapter provide the same cryptographic behavior.