CLM follow-ons: destinations, issuers and service support

Certificate lifecycle management: active increments and remaining extensions.

Released Core baseline: inventory, agent renewal, Windows/IIS, AD CS enrollment and customer Vault publication with Linux consumer rollouts. Release evidence: https://github.com/tokentimerch/tokentimer-core/releases/tag/v0.18.0

IN DEVELOPMENT, NOT RELEASED:

https://github.com/tokentimerch/tokentimer-core/pull/498 — renewal-driven distribution, maintenance scheduling, recurring verification, distribution incidents, administration, recovery and customer-side Vault retention. Real fleet and protected native qualification remain outstanding.

https://github.com/tokentimerch/tokentimer-core/pull/460 — Windows/IIS shared-material consumers, OpenBao and Azure extensions. Merge preparation, migration coordination and protected qualification remain outstanding.

Delivery scope: https://github.com/tokentimerch/tokentimer-core/issues/248

Separate issuer connectors and CA-backed revocation: https://github.com/tokentimerch/tokentimer-core/issues/246

Additional Windows services beyond IIS: https://github.com/tokentimerch/tokentimer-core/issues/504

General certificate-native alerts: https://github.com/tokentimerch/tokentimer-core/issues/360

Distribution incidents in #498 do not complete all certificate-native alerting or vendor-specific ITSM workflows. Source renewal alone does not prove consumer convergence; recording revocation does not revoke at the CA. Availability and qualification must be verified per increment and edition.

Core sequencing: https://github.com/tokentimerch/tokentimer-core/blob/main/ROADMAP.md