{
  "flags": {
    "bus-auth": {
      "enabled": false,
      "state": "off",
      "issue": "0001",
      "description": "Signed control-plane auth + NATS nkey auth. Rollout: off -> soft (verify+log, allow) -> enforce (reject). 'enabled' mirrors state!=off.",
      "added": "2026-06-07",
      "enabled_at": null
    },
    "bus-tls": {
      "enabled": false,
      "issue": "0001",
      "description": "TLS on the NATS data plane using the project's self-signed CA (deploy/tls/). When enabled the server presents its cert and clients pin the CA.",
      "added": "2026-06-07",
      "enabled_at": null
    }
  }
}