ADR 0013 AO mTLS Ada

ADR 0013 — AO Reach mTLS to Ada

Status: Accepted
Date: 2026-08-07
Companions: Contracts — AO Reach, Reach v0.4.1, AO ≥ 1.29

---

Context

Ada AO engine serves HTTPS with required client certificates on :8765 (direct, not via Warpgate). Cleartext HTTP is disabled. COMSTAR must enroll once, persist PEMs, and open wss with that material.

---

Decision

1. orchestration.base_url must be https://… when orchestration.mtls.enabled.
2. Material under ~/.local/share/comstar/ao-mtls/ — never commit PEMs.
3. Enroll once with Ada one-time token (trustEnrollmentCa: true on first pair).
4. Session open passes ReachMtlsConfig; fail closed if enabled but PEMs missing.
5. Admin Ops tab AO pairing is primary UX; make ao-mtls-enroll for SSH.
6. Speech sidecars remain cleartext HTTP (out of scope).

Hallway Ada: https://10.0.10.16:8765. Server cert must include an IP SAN when connecting by address.

Full text: docs/adr/0013-ao-mtls-ada.md in the main repo.

---

Related

• Admin Console
• Configuration
• Contracts — AO Reach
• Security
• ADR Index