$ cat ~/tags/zero-trust — 3 entries
The /now entry commits to moving the last Tally Prime hop off the legacy VPN segment onto ZTNA. This is the plan, not a build log: what Phase 1 proved, what the last hop needs, and what done looks like — no completion claims yet.
Five outputs before any migration sketch: netcheck UDP, DERP reachability, the cert subject names, the NAT shape, and the rollback plan. Drawn from the RDS cutover's transcripts and ADR-003.
When TRA Oman blocked our VPN protocol, operations halted across 4 branches. Here is the technical and business breakdown of how we migrated to Zero Trust architecture and restored operations within 48 hours.