Add Bolt TLS termination as optional feature

plans/05-tls.md

@@ -1,5 +1,21 @@
 # TLS (`bolt+s://`, HTTPS)
 
+## Status
+
+Done: the configuration variables, the three Bolt TLS modes with sniffing on one port
+(`boltage/streams.py`, `handle_client` in `boltage/bolt.py`), stacked transports
+(raw Bolt and WebSocket over TCP or TLS), HTTPS through uvicorn, `+s` schemes in the
+discovery document when TLS is required, and the README documentation, including
+libpq's variables for TLS to PostgreSQL. The container images generate a self-signed
+certificate with `BOLTAGE_TLS_SELF_SIGNED=true` (`container/boltage-start.sh`), off by
+default, and the README explains mounting certificates and using Podman and compose
+secrets.
+
+Still open: reloading the certificate on `SIGHUP`, and adding the TLS checks to the
+tests in the repository
+(they were run by hand against all three modes, and `tests/smoke_test.py` passes
+unchanged over `bolt+ssc://` and `neo4j+ssc://`).
+
 ## Problem
 
 The Bolt port (`asyncio.start_server` in `boltage/__main__.py:46`) and the