add OpenBSD TA constraints and localhost TLS examples

docs/configuration.md

@@ -52,6 +52,7 @@ those choices do not change the built-in defaults.
 | `config-version` | Integer | Explicit `1` required | Configuration schema version, not the software version. Missing or unsupported versions are rejected. |
 | `mode` | String | Required | `validate` or `daemon`; must match the command. |
 | `anchors` | Array of tables | At least one required | Write `[[anchors]]` entries; see section 5. No automatic TAL-directory scan. |
+| `ta-constraints-enabled` | Boolean | true | Apply explicit or adjacent TA constraints files. False skips all constraints loading and enforcement, including adjacent discovery; unused missing or malformed files are ignored. |
 | `ta-refresh-policy` | String | `allow-valid-cache` | On automatic TA download failure, permit a revalidated, usable cached certificate. `require-fresh` prohibits fallback. Does not replace fixed TA files. |
 | `max-ca-depth` | Nonnegative integer | 64 | Maximum CA validation-tree depth. Zero is accepted by configuration parsing, but is a depth limit, not unlimited traversal. Usually keep 64. |
 | `http-timeout-secs` | Nonnegative integer, seconds | 300 | HTTP fetch timeout. Zero is normalized to one second, not unlimited. Does not set the whole-run or rsync timeout. |
@@ -113,7 +114,7 @@ otherwise 3 if strict completion is enabled and any cycle was partial; otherwise
 | `id` | String | TAL filename stem | Identifier in results, logs and constraints. An explicitly empty string also falls back to the filename stem. Resolved IDs must be nonempty and unique; explicit names are preferred. |
 | `tal` | File path | Required | TAL obtained from an independently trusted source; must exist and parse during preflight. Contains certificate URIs and the trusted public key. |
 | `ta` | File path | Omitted: automatic mode | If present, selects a fixed DER TA certificate. Preflight checks binding, certificate profile/signature and validity. Network downloads do not silently replace it. |
-| `constraints` | File path | Discover same-stem `.constraints` | For ripe.tal, try ripe.constraints. Absence of that file means no additional constraints. An explicit path must exist and parse. Omitting this setting does not disable discovery; an empty string is not a disable switch. |
+| `constraints` | File path | Discover same-stem `.constraints` | For ripe.tal, try ripe.constraints. Absence of that file means no additional constraints. When ta-constraints-enabled is true, an explicit path must exist and parse. Omitting this setting does not disable discovery; an empty string is not a disable switch. Set top-level `ta-constraints-enabled = false` to disable all constraints. |
 
 Automatic refresh updates the **TA certificate, never the TAL file**. Each
 validate run or daemon cycle tries the TAL's HTTPS/rsync URIs in order. There is
@@ -292,3 +293,29 @@ produces this excerpt, not the full print output:
 | Logs still JSON | Check top-level settings, recreate the container and inspect new logs. Metadata remains JSON intentionally. |
 | Exited with code 3 | Stopped with partial aggregate results; inspect summaries/lifecycle logs rather than repeatedly stopping. |
 | Latest absent | No complete success yet; partial does not publish even when it exits 0. |
+
+## TA resource constraints
+
+The repository includes five OpenBSD TALs and matching constraints in
+[`tals/`](../tals/README.md), with pinned provenance and checksums. Both all5
+examples explicitly enable them. To customize one anchor, edit its constraints
+file or its `constraints = "/input/custom.constraints"` path. Paths must be
+visible inside the container; relative paths resolve against the TOML directory.
+
+To disable every anchor's constraints, set this **before** `[[anchors]]`:
+
+```toml
+ta-constraints-enabled = false
+```
+
+This takes precedence over explicit paths and same-stem discovery. Re-enable
+with `true`; enabled explicit paths must be readable and syntactically valid.
+Absent adjacent files are allowed for custom TALs without explicit paths.
+Check/print and actual validation use the same selection rules. The summary
+records `taConstraintsEnabled` and `taConstraintsApplied` (anchor IDs and paths).
+A loaded empty file imposes no additional restrictions; enabled alone does not
+imply a file was found.
+
+Each run loads a fresh immutable policy snapshot. Reusing RRDP state does not
+reuse validation results from the previous policy. Stop and recreate the daemon
+to adopt TOML changes; follow the Docker reload procedure after editing files.