fix: clean up inspect CA endpoint display and remove vestigial DefaultExpiration

Use key/value format for CA endpoint status in inspect output to match
the style of other sections (agents, certificates).

Remove unused DefaultExpiration field from discovery responses — it was
plumbed through policy server and CA but never consumed.

Author: brianm

cmd/epithet/inspect.go

@@ -88,11 +88,13 @@ func (i *AgentInspectCLI) Run(parent *AgentCLI, logger *slog.Logger) error {
 		fmt.Printf("  (none)\n")
 	} else {
 		for _, ep := range resp.CaEndpoints {
-			label := "healthy"
+			status := "healthy"
 			if ep.State == "open" || ep.State == "half-open" {
-				label = "broken"
+				status = "broken"
 			}
-			fmt.Printf("  %s (priority %d) — %s\n", ep.Url, ep.Priority, label)
+			fmt.Printf("  %s\n", ep.Url)
+			fmt.Printf("    Priority: %d\n", ep.Priority)
+			fmt.Printf("    Status: %s\n", status)
 		}
 	}
 	fmt.Println()

cmd/epithet/policy.go

@@ -131,9 +131,6 @@ func (c *PolicyServerCLI) Run(logger *slog.Logger, tlsCfg tlsconfig.Config) erro
 		Auth:          &authConfig,
 		MatchPatterns: matchPatterns,
 	}
-	if c.DefaultExpiration != "" {
-		discovery.DefaultExpiration = c.DefaultExpiration
-	}
 
 	handler := policyserver.NewHandler(policyserver.Config{
 		CAPublicKey: sshcert.RawPublicKey(caPubkey),

pkg/ca/ca.go

@@ -179,9 +179,8 @@ type PolicyResponse struct {
 
 // DiscoveryResponse is the discovery data fetched from the policy server.
 type DiscoveryResponse struct {
-	Auth              *BootstrapAuth `json:"auth"`
-	MatchPatterns     []string       `json:"matchPatterns,omitempty"`
-	DefaultExpiration string         `json:"defaultExpiration,omitempty"`
+	Auth          *BootstrapAuth `json:"auth"`
+	MatchPatterns []string       `json:"matchPatterns,omitempty"`
 
 	// CacheControl is the Cache-Control header from the policy server response.
 	// Not serialized to JSON — used by the CA server to pass through to clients.

pkg/caserver/caserver.go

@@ -130,8 +130,7 @@ func (s *caServer) DiscoveryHandler() http.Handler {
 
 		// Build response: always include auth, only include match patterns if authenticated.
 		resp := &ca.DiscoveryResponse{
-			Auth:              discovery.Auth,
-			DefaultExpiration: discovery.DefaultExpiration,
+			Auth: discovery.Auth,
 		}
 		if authenticated {
 			resp.MatchPatterns = discovery.MatchPatterns

pkg/policyserver/discovery_test.go

@@ -17,8 +17,7 @@ func TestHandler_GETDiscovery(t *testing.T) {
 			ClientID: "test-client-id",
 			Scopes:   []string{"openid", "profile", "email"},
 		},
-		MatchPatterns:     []string{"*.example.com", "prod-*"},
-		DefaultExpiration: "5m",
+		MatchPatterns: []string{"*.example.com", "prod-*"},
 	}
 
 	handler := policyserver.NewHandler(policyserver.Config{
@@ -50,10 +49,6 @@ func TestHandler_GETDiscovery(t *testing.T) {
 	if len(got.MatchPatterns) != 2 {
 		t.Errorf("expected 2 match patterns, got %d", len(got.MatchPatterns))
 	}
-	if got.DefaultExpiration != "5m" {
-		t.Errorf("expected default expiration '5m', got %q", got.DefaultExpiration)
-	}
-
 	if ct := w.Header().Get("Content-Type"); ct != "application/json" {
 		t.Errorf("expected Content-Type 'application/json', got %q", ct)
 	}

pkg/policyserver/policyserver.go

@@ -29,9 +29,8 @@ type Response struct {
 // DiscoveryResponse is returned by GET / on the policy server.
 // The CA fetches this and serves it to clients on /discovery.
 type DiscoveryResponse struct {
-	Auth              *BootstrapAuth `json:"auth"`
-	MatchPatterns     []string       `json:"matchPatterns,omitempty"`
-	DefaultExpiration string         `json:"defaultExpiration,omitempty"`
+	Auth          *BootstrapAuth `json:"auth"`
+	MatchPatterns []string       `json:"matchPatterns,omitempty"`
 }
 
 // PolicyEvaluator makes authorization decisions based on identity and connection details.