v0.0.6 - Tier-1 TCP listener + FIPS deployment documentation

README.md

@@ -237,6 +237,9 @@ Naming rules:
 Discovery:
 
 - `nsigner list` enumerates currently bound `nsigner_*` abstract sockets by reading `/proc/net/unix`.
+- `nsigner --listen stdio` runs one framed JSON-RPC request/response over stdin/stdout.
+- `nsigner --listen qrexec` is the same stdio framing mode, but caller identity can be derived from `QREXEC_REMOTE_DOMAIN` (displayed as `qubes:<source-vm>`).
+- `nsigner --listen tcp:127.0.0.1:PORT` (or `tcp:[::1]:PORT`) enables loopback-only TCP listening for non-AF_UNIX clients.
 
 ### 7.2 ESP32 MCU: USB-CDC serial
 
@@ -288,6 +291,24 @@ To force a specific socket name (e.g. for scripted clients):
 nsigner --name my_test_signer
 ```
 
+Qubes/qrexec service mode (single framed request over stdin/stdout):
+
+```bash
+nsigner --listen qrexec
+```
+
+Generic stdio transport mode (single framed request over stdin/stdout):
+
+```bash
+nsigner --listen stdio
+```
+
+TCP loopback transport mode (no TUI; serves requests until terminated):
+
+```bash
+nsigner --listen tcp:127.0.0.1:8080
+```
+
 ### 9.2 Send a request (client mode)
 
 From another terminal, target the signer by its socket name:
@@ -365,6 +386,9 @@ Static build:
 ## 11. Document map
 
 - [`README.md`](README.md): authoritative behavior specification for the foreground single-program model
+- [`documents/CLIENT_IMPLEMENTATION.md`](documents/CLIENT_IMPLEMENTATION.md): client integration contract and framing behavior
+- [`documents/QUBES_OS.md`](documents/QUBES_OS.md): Qubes OS deployment/integration checklist for dedicated signer qubes
+- [`documents/FIPS_DEPLOYMENT.md`](documents/FIPS_DEPLOYMENT.md): Tier-1 FIPS deployment runbook using loopback TCP listener
 - [`plans/nsigner.md`](plans/nsigner.md): implementation plan and sequencing
 - [`plans/seed_phrase_uses.md`](plans/seed_phrase_uses.md): seed phrase domain/use catalog and caveats
 - [`firmware/README.md`](firmware/README.md): firmware-side notes for MCU transport/UI integration