Harden public documentation and access-control boundaries

[DataTideHH]

What changed

• removes real institution-managed Windows hostnames and volatile device-management details from the current public documentation
• replaces the iMac "always-on" wording with an explicit availability boundary
• narrows current-state claims to the connection paths actually validated in June 2026
• adds a public-safe access-control model for managed-client to macOS-target SSH on TCP 22
• distinguishes Tailnet visibility, connectivity and authorization
• documents temporary trust, organizational permission and offboarding for school-managed devices
• adds device-approval, key-expiry and lifecycle review criteria
• clarifies that the tested service is native macOS OpenSSH over Tailscale, not Tailscale SSH
• adds dated, role-based connection-test records
• synchronizes README, architecture, hardware, security, setup, troubleshooting, decision record, portfolio context, checklist and topology
• adds a narrow, identity-free grants policy example
• expands .gitignore for private policy exports, enrollment artifacts, raw output and admin-console exports
• adds a Python 3.12 public-safety validator and GitHub Actions CI

Why

The previous baseline was useful but had two material gaps:

• the public hardware file contained real school-device hostnames and unnecessary volatile endpoint details despite the repository's privacy rules
• the documentation showed enrolled devices and successful tests without explicitly documenting the intended least-privilege access path, temporary trust or offboarding boundary

This PR keeps the project small while making its security and portfolio claims more precise.

Deliberate scope

• no private Tailnet policy is published
• no real user, device, Tailnet, address, key or fingerprint is included
• no public port forwarding, subnet router, exit node, Funnel, Serve or Tailscale SSH is added
• no productive WireGuard server is implemented
• no claim is made that the example policy is the current private configuration
• no availability or enterprise zero-trust claim is added

Validation

The Public safety workflow uses Python 3.12 to:

• compile the repository validator
• confirm required security artifacts exist
• scan public text files for the removed hostnames
• reject real-looking Tailscale IPv4 addresses
• reject private-key material, SSH fingerprints and Tailscale auth keys
• verify WireGuard private-key values remain placeholders
• parse the example policy
• verify that its only grant is tag:managed-client to tag:remote-target on tcp:22
• reject broad internet, default-route or all-port policy values

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5e8e2e7d9f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Remove the real hostnames from the validator

In a public checkout, each join reconstructs the exact institution-managed hostname that this commit claims to remove, and the descriptions explicitly confirm that the values are real. Splitting the strings only hides them from simple searches; anyone reading or executing the validator can recover the device identifiers. Replace these values with a non-reversible representation such as hashes, or remove this device-specific blacklist, so the public-safety change does not republish the sensitive identifiers.

Useful? React with 👍 / 👎.