Document the cross-host control-plane bridge (socat TCP on tailscale0 →
colibri-daemon Unix socket): FreeBSD rc.d vs Linux systemd parity, the
interface-scoped firewall gate (pf / ufw), the "tailnet boundary is the auth"
security model (no socket auth; scope :9190 via Tailscale ACL), and config
notes (TAILSCALE_IP_REQUIRED placeholder, socket-path parity, 0770 group).
Points at packaging/{freebsd,linux}/ for install. Linked from the architecture
index next to Control Plane. No real tailnet IPs (placeholders only).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The terminal-capture / signature-triage layer (colibri-glasspane terminal.rs
+ signatures.rs, driven by the daemon poll loop) had no guide coverage. Document
it: content-hash dedup history, edge-triggered signature alerts, per-OS
signature sets, the COLIBRI_TERMINAL_* / TELEGRAM_* config, and the
terminal-watch/unwatch/list/history/poll socket commands. Linked from the
operate index.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
