M14: split into M14-backend + M14-ui, M14-backend runs before M13

User decision: finish all backend work before the frontend. 5 of
6 M14 workstreams are backend-only (cert-manager + ingestd mTLS +
gRPC mTLS + rotation + alerts + smoke). W4 (cert UI) is the only
frontend piece.

Reorder:
  - M14-backend (W1, W2, W3, W5, W6) — runs after M12 W1, in
    parallel with M13a. 13-18d.
  - M14-ui (W4) — runs inside M13b W2 as a feature incremental
    on the Sources module. 3-5d.

M14_SECURITY_PLAN.md §10: addendum documenting the split, updated
sequencing diagram, and how SPEC.md rows should be split into
'M14 (backend)' and 'M14 (ui)'.

M13b_PLAN.md W2: Sources CRUD scope grows to include the cert
lifecycle UI (CSR upload, auto-generate, revoke, expiration
banner). Estimate 2-3d → 4-6d. New exit criteria for the cert
tab. M13c unchanged.

M14-backend exit criteria unchanged. M14-ui smoke folded into
M13b smoke.

Co-Authored-By: Jarvis <jarvis@techno-world.net>

M13b_PLAN.md

@@ -129,6 +129,26 @@ create/rotate.
 - Quarantine badge: if `quarantine_until` is in the future, show
   a red badge with the remaining time.
 - Filter by company (super), type, status.
+- **Cert lifecycle sub-feature (M14-ui, formerly M14 W4):**
+  - Tabs in Source detail: "Auth" (HMAC + API key) and "Cert"
+    (mTLS).
+  - `CertStatusBadge` — green/amber/red based on expiration.
+  - `CertUploadCSRDialog` — paste a CSR, get a signed cert back.
+  - `CertAutoGenerateDialog` — server generates key + CSR, signs
+    it, returns a downloadable `.zip` with cert + chain + key.
+  - `CertRevokeDialog` — typed confirmation.
+  - `CertExpirationBanner` — global banner in top bar when any
+    source cert is < 30 days from expiry.
+  - New endpoints (already in M14-backend):
+    - `POST /v1/sources/:id/cert/csr`
+    - `GET /v1/sources/:id/cert`
+    - `DELETE /v1/sources/:id/cert`
+    - `GET /v1/certs/expiring?days=30`
+  - Only renders if `source.mtls_required=true` OR the source
+    already has a cert. Else, the Cert tab shows "mTLS not
+    enabled for this source — enable in the Auth tab".
+  - Tenant-admin sees cert info for their sources (read-only,
+    no revoke).
 
 **Exit criteria:**
 - [ ] Create source: form validates, one-time secrets shown once
@@ -141,9 +161,20 @@ create/rotate.
       (verified by curl).
 - [ ] Quarantine badge visible when `quarantine_until` is set.
 - [ ] Tenant-admin sees only their company's sources.
-- [ ] Bundle: sources feature code-split (< 40 KB gzipped).
-
-**Estimated:** 2-3 days.
+- [ ] Cert tab: super-admin can upload a CSR, get a signed cert.
+- [ ] Cert tab: "Auto-generate" returns a `.zip` with cert +
+      chain + private key (one-time download).
+- [ ] Cert tab: revoke removes the cert; subsequent requests with
+      that cert fail within 60s.
+- [ ] CertExpirationBanner appears 30 days before any cert expires.
+- [ ] Tenant-admin sees cert info for their sources (read-only,
+      no revoke).
+- [ ] M14-ui smoke: `make m13b-smoke` includes the cert path
+      (mTLS-required source + cert issued + revoke + 60s window).
+- [ ] Bundle: sources feature code-split (< 50 KB gzipped,
+      includes cert sub-feature).
+
+**Estimated:** 4-6 days (was 2-3 before M14-ui was added).
 
 ---
 

M14_SECURITY_PLAN.md

@@ -516,6 +516,71 @@ separate project (M15).
 
 ---
 
-**Next step:** start W1 (cert-manager + CA). If we have 2
-engineers, W4 UI work starts as soon as M13b W1 (Companies CRUD)
-is done — the cert UI is a Sources incremental.
+## 10. Addendum (2026-06-16) — execution ordering: M14-backend before M13
+
+**Decision (option A, confirmed by user):** M14 is split into two
+execution phases that decouple from M13:
+
+| Phase | Workstreams | Type | Runs when | Estimates |
+|---|---|---|---|---|
+| **M14-backend** | W1 + W2 + W3 + W5 + W6 | Backend (K8s + Go + PromQL + smoke) | **Before M13a.** Parallel with M13a. | 13-18d |
+| **M14-ui** | W4 | Frontend (Vite + React) | **Inside M13b W2** (Sources module), as a feature incremental | 3-5d |
+
+**Why split:** user wants all backend work finished before the
+frontend. 5 of 6 workstreams are backend-only; W4 is the only one
+that touches the UI. M14-ui becomes a feature of the Sources module
+in M13b, not a standalone milestone.
+
+**Updated sequencing:**
+
+```
+M12 W1 (K8s) ─┬─▶ M14-backend W1 (cert-manager) ─▶ M14 W2 (ingestd mTLS)
+              │                                       │
+              │                                       ├─▶ M14 W3 (gRPC mTLS)
+              │                                       │
+              │                                       └─▶ M14 W5 (rotation + alerts) ─▶ M14 W6 (smoke)
+              │
+              └─▶ M13a W1 (authd) ─▶ M13a W2-W4 (web shell + JWT gate)
+                                              │
+                                              └─▶ M13b W1 (Companies) ─▶ M13b W2 (Sources + M14-ui W4) ─▶ M13b W3 (Telegram) ─▶ M13c
+```
+
+**What this means for M13 plans:**
+
+- `M13b_PLAN.md` W2 (Sources CRUD) grows by ~3-5d to include the
+  cert lifecycle UI (M14 W4). The cert UI is a new tab in the
+  Source detail page.
+- `M13c_PLAN.md` is unchanged (no cert work needed there).
+- `M14 W4 exit criteria` move into `M13b_PLAN.md` W2 as a
+  sub-section.
+
+**What this means for M14-backend:**
+
+- W1-W3, W5, W6 ship as **M14-backend** with its own
+  `M14_BACKEND_VERIFICATION.md` and a SPEC.md row flip.
+- M14-backend is independent of M13a. Both can run in parallel
+  after M12 W1 lands.
+- M14-ui ships as part of M13b; no separate verification doc.
+
+**SPEC.md M14 row should be split** into:
+
+- `M14 (backend)` — mTLS opt-in per source + cert-manager +
+  rotation + alerts + runbook + smoke. Targets: enterprise
+  technical controls.
+- `M14 (ui)` — Cert lifecycle UI in Sources module. Ships as
+  part of M13b.
+
+**Exit criteria (whole M14, both phases):**
+
+- [ ] M14-backend: `make m14-smoke` green for 3 consecutive runs
+      (the existing W6 smoke, unchanged).
+- [ ] M14-backend: M14_VERIFICATION.md published.
+- [ ] M14-ui: cert UI ships inside M13b, covered by M13b smoke +
+      Playwright E2E (M13c).
+- [ ] SPEC.md rows: `M14 (backend)` and `M14 (ui)` both flipped
+      to ✅ shipped.
+- [ ] Runbook reviewed by 2 people.
+- [ ] No regression on M11 / M12.
+
+**Next step:** start M14-backend W1 (cert-manager + CA). M13a W1
+(authd) can start in parallel.