Regulated-edition tier: FIPS · RBAC/PIV · HSM/KMS · reproducible build · NIST 800-53 (deferred from #80)

[sandstream]

Split out of the air-gap epic #80. This is a separate product tier, not part
of the air-gap core (which is shipped end-to-end).

Scope (accreditation-grade, decision-gated):

• FIPS-validated crypto
• RBAC / PIV / smartcard auth
• HSM / KMS-held key material
• reproducible / fully-vendored build
• accreditation docs mapped to NIST 800-53
• native Windows (docs: document platform support — macOS/Linux native, Windows via WSL2 #44)

Tracked separately so the delivered air-gap epic can close without implying these
are pending against it.

🤖 Generated with Claude Code