Fetch one narrow cert-manager provisioning command

POST 
/api/v1/certops/executor/provisioning-commands/next

Controller-specific command transport. Requires exactly certops:provision:execute and immutable controller cluster binding. It is not agent polling or claim protocol. Non-terminal work may be redelivered after a bounded throttle; no Secrets or private material are returned.

Responses

200

One cluster-bound provisioning command

204

No work assigned to the authenticated cluster

401

Unauthorized

403

Forbidden

404

Not found

409

Workspace CertOps is paused

422

Request rejected because it contained private key material

429

CertOps machine-token rate limit exceeded

500

Command dispatch failed after selection (CERTOPS_CONTROLLER_PROVISIONING_COMMAND_FAILED)