lmd owns endpoint-local inspection, trust, and future reconciliation work. It does not become the organization control plane and does not treat LAN, VPN, or localhost reachability as authorization.
The current private implementation provides local dogfood foundations and an independent linuxmice-endpoint package skeleton. Remote enrollment, fleet policy, staged updates, production certificate lifecycle, and installed-system upgrade evidence remain open.