mervin008 · Sep 24, 2026 · Sep 24, 2026 · Sep 24, 2026
diff --git a/docs/.vitepress/config.ts b/docs/.vitepress/config.ts
@@ -87,7 +87,7 @@ export default withMermaid(
        * hamburger.
        */
       nav: [
-        { text: 'Evaluate', link: '/evaluation', activeMatch: '^/(evaluation|getting-started|architecture|status|compatibility)' },
+        { text: 'Evaluate', link: '/evaluation', activeMatch: '^/(evaluation|comparison|getting-started|architecture|status|compatibility)' },
         { text: 'Walkthroughs', link: '/walkthroughs/', activeMatch: '^/walkthroughs' },
         { text: 'Deploy', link: '/configuration', activeMatch: '^/(configuration|database|operations|security)' },
         { text: 'Operate', link: '/discovery', activeMatch: '^/(discovery|monitoring|deployment|templates|posture|troubleshooting)' },

diff --git a/docs/.vitepress/guide-sidebar.json b/docs/.vitepress/guide-sidebar.json
@@ -7,6 +7,10 @@
         "text": "Evaluate CertPilot",
         "link": "/evaluation"
       },
+      {
+        "text": "How it compares",
+        "link": "/comparison"
+      },
       {
         "text": "Getting started",
         "link": "/getting-started"

diff --git a/docs/comparison.md b/docs/comparison.md
diff --git a/docs/deployment.md b/docs/deployment.md
@@ -1,14 +1,14 @@
 ---
 editLink: false
-lastUpdated: 2026-09-21T21:48:46Z
+lastUpdated: 2026-09-24T21:03:20Z
 source:
   repo: certpilot/certpilot
   path: docs/deployment.md
-  commit: 9e9a566000099c09d1f96546a3b48910ca0fa6db
+  commit: 3d0a4bbf19f28a3596cfcd41d01eccb8b32df74b
 ---
 
-<!-- Synced from docs/deployment.md in certpilot/certpilot at 9e9a56600009,
-     last changed 2026-09-21T21:48:46Z, by scripts/sync-pages.mjs. Edit it there, not here. -->
+<!-- Synced from docs/deployment.md in certpilot/certpilot at 3d0a4bbf19f2,
+     last changed 2026-09-24T21:03:20Z, by scripts/sync-pages.mjs. Edit it there, not here. -->
 
 # Deployment
 
@@ -141,6 +141,10 @@ from the one asked for.
 SigV4 is signed by hand ([`core/engine/cloudsync/sigv4.go`](https://github.com/certpilot/certpilot/blob/main/core/engine/cloudsync/sigv4.go)).
 There is no AWS SDK anywhere in this project.
 
+> Tested against a fake that answers the way ACM does. Nothing in this
+> repository or its CI holds an AWS credential, so AWS itself has never checked
+> one of these signatures.
+
 ### azure_key_vault
 
 ```json

diff --git a/docs/documentation-checks.md b/docs/documentation-checks.md
@@ -1,14 +1,14 @@
 ---
 editLink: false
-lastUpdated: 2026-09-23T06:59:39Z
+lastUpdated: 2026-09-24T21:03:20Z
 source:
   repo: certpilot/certpilot
   path: docs/documentation-checks.md
-  commit: bc8c475b00fd7bb7c04dfb24906aabe8b3b80646
+  commit: 3d0a4bbf19f28a3596cfcd41d01eccb8b32df74b
 ---
 
-<!-- Synced from docs/documentation-checks.md in certpilot/certpilot at bc8c475b00fd,
-     last changed 2026-09-23T06:59:39Z, by scripts/sync-pages.mjs. Edit it there, not here. -->
+<!-- Synced from docs/documentation-checks.md in certpilot/certpilot at 3d0a4bbf19f2,
+     last changed 2026-09-24T21:03:20Z, by scripts/sync-pages.mjs. Edit it there, not here. -->
 
 # Documentation checks
 
@@ -31,6 +31,7 @@ that the site shows what this repository says.
 | `npm run check:links` in certpilot-docs | Every link, anchor, image and stylesheet on the **built** site lands | Links to other sites | Every certpilot-docs pull request, after the build |
 | `make test-doc-versions` | Every pinned image tag, module version and release ref is published. Each page names one version per component, and a pinned gateway or agent is one [compatibility.md](/compatibility) measured | Whether a pinned *combination* works. Only the evaluation run shows that, and only for its own pair | Docs pull requests, weekly |
 | `make test-evaluation` | [evaluation.md](/evaluation), run as written against the release it pins, does what sixteen of its sentences say | Every sentence it does not assert | Docs pull requests, weekly |
+| `make test-comparison-sources` | Every vendor sentence [comparison.md](/comparison) quotes is still on the vendor's page, and every claim there cites a source the page lists | Whether the vendor's documentation is right, or anything it does not say | Weekly, and on pull requests that change the comparison |
 | `sync:pages --check` and `sync:guides --check` in certpilot-docs | The site shows exactly what this repository says, and records which commit it came from | Whether this repository is right | Every certpilot-docs pull request |
 | `make test-doc-checks` and `npm run test:checks` | Each check above fails on the breakage it exists to catch, and passes once that is corrected | Nothing beyond that. This one checks the checks | Docs pull requests, weekly |
 
@@ -64,6 +65,7 @@ that existed, because every check reads syntax, and these were about behaviour.
 | The agent and the gateways "both speak gRPC" | A draft, caught in review | The agent speaks REST and has no `.proto` | Never published |
 | Vault is "the only gateway that answers GetCAInfo" | A draft, caught in review | ACME answers it as well. Vault is the only one that returns *issuers* | Never published |
 | `config.example.yaml` "defaults to a wildcard CORS origin" | A draft, caught in review | It sets `http://localhost:3000` | Never published |
+| Deploying to servers: "Two of those five are 🧪" | `status.md` | Three are. The AWS ACM deployer has only ever answered a stub, and no CI job holds an AWS credential. Found while writing the comparison on 24 September | Two days as that sentence. The ✅ it replaced had said all five |
 
 The two that were published follow the same pattern, and it is the one most
 worth knowing. **A sentence saying that something does not exist was true when

diff --git a/docs/evaluation.md b/docs/evaluation.md
@@ -1,14 +1,14 @@
 ---
 editLink: false
-lastUpdated: 2026-09-22T22:16:14Z
+lastUpdated: 2026-09-24T21:03:20Z
 source:
   repo: certpilot/certpilot
   path: docs/evaluation.md
-  commit: 644ae5280b83d4ad4c6949c0a936ee05c999e664
+  commit: 3d0a4bbf19f28a3596cfcd41d01eccb8b32df74b
 ---
 
-<!-- Synced from docs/evaluation.md in certpilot/certpilot at 644ae5280b83,
-     last changed 2026-09-22T22:16:14Z, by scripts/sync-pages.mjs. Edit it there, not here. -->
+<!-- Synced from docs/evaluation.md in certpilot/certpilot at 3d0a4bbf19f2,
+     last changed 2026-09-24T21:03:20Z, by scripts/sync-pages.mjs. Edit it there, not here. -->
 
 # Evaluate CertPilot
 
@@ -257,3 +257,10 @@ stack does the wrong way on purpose:
 
 `deploy/docker-compose.yml` and `deploy/config.production.example.yaml` are the
 files to start from for that, and [operations](/operations) is the page.
+
+## Whether it is the right tool at all
+
+[How CertPilot compares](/comparison) puts it beside Keyfactor Command, Palo
+Alto Networks' Next-Generation Trust Security and DigiCert Trust Lifecycle
+Manager. It uses only what each vendor documents, dates every source, and says
+when one of them fits better than this does.
diff --git a/docs/security.md b/docs/security.md
@@ -1,14 +1,14 @@
 ---
 editLink: false
-lastUpdated: 2026-09-14T08:49:03Z
+lastUpdated: 2026-09-24T21:03:20Z
 source:
   repo: certpilot/certpilot
   path: docs/security.md
-  commit: 95b0481beab6b8ff0992e82b1bf81913c39620ba
+  commit: 3d0a4bbf19f28a3596cfcd41d01eccb8b32df74b
 ---
 
-<!-- Synced from docs/security.md in certpilot/certpilot at 95b0481beab6,
-     last changed 2026-09-14T08:49:03Z, by scripts/sync-pages.mjs. Edit it there, not here. -->
+<!-- Synced from docs/security.md in certpilot/certpilot at 3d0a4bbf19f2,
+     last changed 2026-09-24T21:03:20Z, by scripts/sync-pages.mjs. Edit it there, not here. -->
 
 # Security model
 
@@ -530,8 +530,9 @@ internally consistent. Detecting either needs the head tag published somewhere
 append-only — a second system, an object-lock bucket, a printed page — on a
 schedule. Not built.
 
-**Key Vault and F5 deployers are unit-tested only.** Written to their published
-APIs; never run against a real vault or appliance.
+**The AWS ACM, Key Vault and F5 deployers are tested against fakes only.**
+Written to their published APIs; never run against a real AWS account, vault or
+appliance.
 
 **The KEK is held in the core's memory.** It can now be loaded from a file or
 from Vault rather than an environment variable, but wherever it comes from the

diff --git a/docs/status.md b/docs/status.md
@@ -1,14 +1,14 @@
 ---
 editLink: false
-lastUpdated: 2026-09-22T07:37:13Z
+lastUpdated: 2026-09-24T21:03:20Z
 source:
   repo: certpilot/certpilot
   path: docs/status.md
-  commit: da9423f87e1a52249cf9d42a7a2a8d04e5413775
+  commit: 3d0a4bbf19f28a3596cfcd41d01eccb8b32df74b
 ---
 
-<!-- Synced from docs/status.md in certpilot/certpilot at da9423f87e1a,
-     last changed 2026-09-22T07:37:13Z, by scripts/sync-pages.mjs. Edit it there, not here. -->
+<!-- Synced from docs/status.md in certpilot/certpilot at 3d0a4bbf19f2,
+     last changed 2026-09-24T21:03:20Z, by scripts/sync-pages.mjs. Edit it there, not here. -->
 
 # Implementation status
 
@@ -77,7 +77,7 @@ This is early development software. Do not run it in production yet.
 | Notifications | 🧪 | Slack (Block Kit), signed generic webhook, SMTP email. Deliberately not Teams or PagerDuty. Every transport is tested against a fake receiver; none against the real service |
 | Store conformance testing | ✅ | One suite run against both the in-memory store and a real PostgreSQL, covering the four classes of defect that had only ever been found by running the thing. Plain PostgreSQL is a supported target and proven by the suite |
 | Cryptographic posture | ✅ | Which endpoints negotiate a post-quantum key exchange and which do not, from real handshakes; CNSA 2.0 conformance per certificate; CycloneDX 1.6 CBOM export validated against the published schema. Post-quantum *issuance* waits for `crypto/x509` |
-| Deployment to servers | ⚠️ | Durable, retried, audited deployment to a signed webhook, a host running the agent, AWS ACM, Azure Key Vault and F5 BIG-IP. **Two of those five are 🧪.** **A renewal deploys itself**, and a failing target halts the rest of the rollout rather than letting a bad certificate march through the estate. The webhook and agent targets are exercised end to end by CI; Key Vault and F5 are written to their published APIs and unit-tested, and neither has ever been run against a real vault or appliance |
+| Deployment to servers | ⚠️ | Durable, retried, audited deployment to a signed webhook, a host running the agent, AWS ACM, Azure Key Vault and F5 BIG-IP. **Three of those five are 🧪.** **A renewal deploys itself**, and a failing target halts the rest of the rollout rather than letting a bad certificate march through the estate. The webhook and agent targets are exercised end to end by CI; AWS ACM, Key Vault and F5 are written to their published APIs and tested against fakes, and none has ever been run against a real AWS account, vault or appliance |
 | Deployment profiles | ✅ | Ten platforms the agent installs to by name: nginx, Apache, HAProxy, Caddy, Tomcat, PostgreSQL, MariaDB/MySQL, Postfix, Dovecot, IIS. The nine Linux ones are tested by `make verify-profiles` in [certpilot-agent](https://github.com/certpilot/certpilot-agent), which runs the service in a container, installs a certificate through the agent, and confirms over TLS that the service returns it after reloading; IIS cannot run in a container and is held to the same bar on a Windows runner instead. A profile supplies defaults; any field set on the destination takes precedence. See [platforms](/platforms/) |
 | Host agent | ✅ | One binary that enrols, inventories, **requests certificates with keys it generates locally and never sends** — CertPilot cannot produce them and does not claim to — then installs them where the server actually reads them and reloads it — as PEM, as a PKCS#12 keystore for anything on the JVM, or into the Windows certificate store for [IIS](/platforms/iis), which reads no file at all. Bounded by grants an operator writes in advance — which now say *which template* a host may use, so the same rules and the same estate-wide floor apply to a host as to a person. Linux and Windows — see [where it runs](/agent#where-it-runs) |
 | Vault issuers in the CA inventory | ✅ | Connecting a CA account records the CAs behind it, and from that moment they are monitored, thresholded and alerted on like everything else. The importer refreshes what the certificate says and never touches what an operator decided — the name, the thresholds, the owning team |
@@ -118,8 +118,10 @@ with their reasoning in [security.md](/security#known-gaps).
 - The audit chain has no external anchor. An attacker holding both the database
   and the key encryption key can rewrite it wholesale, or truncate the newest
   entries.
-- The Azure Key Vault and F5 BIG-IP deployers are written to their published
-  APIs and unit-tested. Neither has been run against a real vault or appliance.
+- The AWS ACM, Azure Key Vault and F5 BIG-IP deployers are written to their
+  published APIs and tested against fakes. None has been run against a real
+  AWS account, vault or appliance, so ACM's hand-signed requests have never been
+  checked by AWS itself.
 - **Six capabilities are marked 🧪 above**: External Account Binding, OIDC
   authentication, CA expiry alerting, notifications, cloud inventory and
   Certificate Transparency. Each depends on a third party — an identity

diff --git a/scripts/sync-pages.mjs b/scripts/sync-pages.mjs
@@ -97,6 +97,7 @@ const check = process.argv.includes('--check')
  */
 const PAGES = [
   { source: 'evaluation.md', sentinel: '## 1. Start it' },
+  { source: 'comparison.md', sentinel: '# How CertPilot compares' },
   { source: 'getting-started.md', sentinel: '## 1. Generate development keys' },
   { source: 'architecture.md', sentinel: '## Decision 1 — a gateway is a process, not a package' },
   { source: 'discovery.md', sentinel: '## Certificate Transparency' },