Reviewer finding, not yet independently confirmed.
handlePKIEnrollment (internal/agent/enrollment.go:46-99) publishes the enrollment request once and only logs a warning on failure before entering Pending. The controller never receives the request, and Start() only starts consumers when the agent is not Pending (internal/agent/server.go:113), so the agent never processes jobs until it is restarted.
Fix: retry the enrollment request periodically while the agent is Pending, for example on the heartbeat ticker.
Found in the September 2026 codebase review. Tracked in the review tracking issue.
Reviewer finding, not yet independently confirmed.
handlePKIEnrollment(internal/agent/enrollment.go:46-99) publishes the enrollment request once and only logs a warning on failure before entering Pending. The controller never receives the request, andStart()only starts consumers when the agent is not Pending (internal/agent/server.go:113), so the agent never processes jobs until it is restarted.Fix: retry the enrollment request periodically while the agent is Pending, for example on the heartbeat ticker.
Found in the September 2026 codebase review. Tracked in the review tracking issue.