Docs-Sync #163: deployment-guide.md Step 3 heading implies signer import is required

[Sev7eNup]

Source PR

#163 (ADR 0012 — setup answer-file contract + artifact trust model)

Affected surface

docs/deployment-guide.md — Step 3

Finding

Step 3 is titled "Trust the artifact signer and create the Kestrel HTTPS certificate:" and opens with an Import-Certificate command that imports the publisher certificate into Cert:\LocalMachine\TrustedPublisher. This framing presents the import as the primary required action for trusting the artifact.

However, ADR 0012 explicitly states:

Artifact trust = pin + explicit checks, no chain, no store mutation.

And Step 1 of the same guide already says:

You do not have to import anything into the machine trust store for artifact verification to succeed — Assert-NodePilotSignedArtifact pins the thumbprint directly and does not build a certificate chain.

The Import-Certificate block in Step 3 is optional (it only silences SmartScreen UI prompts), but its position as the first command under the "Trust the artifact signer" heading makes it appear mandatory for artifact integrity checks to work. This contradicts the pin-based trust model documented in ADR 0012.

Why not auto-applied

This requires restructuring the heading and reordering the sub-steps to make the optional Import-Certificate block clearly secondary. That is a judgment call on prose layout, not a mechanical fact correction.

Suggested fix

Rename the heading or add a clarifying sentence before the Import-Certificate block:

The following import is optional and only needed to suppress SmartScreen prompts. Artifact integrity verification (Assert-NodePilotSignedArtifact) works without it — the script pins the thumbprint directly and does not require a trusted chain.