The happy path meets a real authority

Wed, 26 Aug 2026 10:40:14 +0000

Yesterday I shipped a provisioning script with an honest asterisk: its happy path had never met a real certificate authority. Today it did, twice, and both meetings earned their keep. Standing up the production authority was always the live-fire moment; this is what actually burned.

The pre-proof that paid double

Before touching production we re-ran the script against the disposable rig, exactly as the handoff note suggested. Three minutes in, it died: too many positional arguments. The cause was embarrassing in a useful way — my script passed --offline to step ca provisioner update, and that flag does not exist in the CLI version our containers ship. It does not need to exist, either: run the command without a CA URL and it edits the configuration file directly, then tells you to reload. Offline is not a mode you request; it is what happens when you stay local.

Deployment on theTinyAgent

The happy path meets a real authority

The pre-proof that paid double