[ { "id": "01-system-context", "title": "Container Supply Chain — System Context", "layout": "context", "system": { "label": "Container Supply Chain Platform", "sub": "commit to admitted pod" }, "colWidth": 260, "groups": [ { "side": "left", "title": "People", "nodes": [ { "id": "dev", "label": "Developer", "kind": "actor", "rel": "reads deny reason", "dir": "in", "icon": "role_developer" }, { "id": "sec", "label": "Security Engineer", "kind": "actor", "rel": "authors policy", "dir": "in", "icon": "role_secops" }, { "id": "apr", "label": "Exception Approver", "kind": "actor", "rel": "grants, with expiry", "dir": "in", "icon": "person_approver" }, { "id": "sre", "label": "Platform SRE", "kind": "actor", "rel": "operates", "dir": "in", "icon": "role_devops" } ] }, { "side": "top", "title": "Producers", "nodes": [ { "id": "bld", "label": "Build Pipelines", "kind": "external", "sub": "Tekton", "rel": "push + attest", "dir": "in", "icon": "fa5_hammer" }, { "id": "bif", "label": "Base Image Factory", "kind": "external", "rel": "hardened bases", "dir": "in", "icon": "fa5_layer_group" }, { "id": "ups", "label": "Upstream Registries", "kind": "external", "sub": "Docker Hub · Quay", "rel": "proxy cache", "dir": "in", "icon": "fa5_warehouse" } ] }, { "side": "right", "title": "Consumers", "nodes": [ { "id": "k8s", "label": "Kubernetes Clusters", "kind": "external", "sub": "prod · stage · dev", "rel": "admission review", "icon": "kubernetes" }, { "id": "edge", "label": "Edge and Air-Gapped", "kind": "external", "rel": "offline verify", "icon": "kubernetes" }, { "id": "gitops", "label": "Argo CD", "kind": "external", "rel": "deploys digests", "icon": "argocd" } ] }, { "side": "bottom", "title": "Sources of truth we do not own", "nodes": [ { "id": "scm", "label": "GitLab", "kind": "external", "rel": "source revision", "dir": "in", "icon": "gitlab" }, { "id": "osv", "label": "OSV Mirror", "kind": "external", "rel": "advisories", "dir": "in", "kind2": "async", "icon": "external_feed" }, { "id": "distro", "label": "Distro and NVD Feeds", "kind": "external", "rel": "advisories", "dir": "in", "kind2": "async", "icon": "external_feed" }, { "id": "idp", "label": "Keycloak and SPIRE", "kind": "external", "rel": "workload identity", "dir": "in", "icon": "keycloak" } ] } ], "note": "Build systems, cluster runtimes and the applications themselves are integrated with, not replaced.", "meta": { "v": "1.0", "owner": "Enterprise Architecture", "date": "2026-09" } }, { "id": "02-high-level-architecture", "title": "Container Supply Chain — High-Level Architecture", "layout": "flow", "chain": true, "canvas": { "width": 1800 }, "nodeWidth": 190, "stages": [ { "title": "Source", "nodes": [ { "id": "h-scm", "label": "GitLab", "kind": "external", "sub": "app + policy repos", "icon": "gitlab" } ] }, { "title": "Build and attest", "nodes": [ { "id": "h-tkn", "label": "Tekton Pipelines", "kind": "app", "sub": "ephemeral runners", "icon": "fa5_hammer" }, { "id": "h-chn", "label": "Tekton Chains", "kind": "app", "sub": "SLSA v1 provenance", "icon": "fa5_hammer" }, { "id": "h-syf", "label": "Syft", "kind": "app", "sub": "CycloneDX SBOM", "icon": "fa5_clipboard_list" } ] }, { "title": "Artifact plane", "nodes": [ { "id": "h-hbr", "label": "Harbor Registry", "kind": "integration", "sub": "OCI 1.1 referrers", "icon": "fa5_warehouse" }, { "id": "h-min", "label": "MinIO", "kind": "store", "sub": "14 TB · EC 8+4", "icon": "minio" } ] }, { "title": "Evidence plane", "nodes": [ { "id": "h-att", "label": "Attestation Store", "kind": "store", "sub": "append-only · 7 y", "icon": "fa5_file_contract" }, { "id": "h-rek", "label": "Rekor", "kind": "security", "sub": "transparency log", "icon": "fa5_scroll" }, { "id": "h-idx", "label": "Component Index", "kind": "store", "sub": "ClickHouse", "icon": "clickhouse" } ] }, { "title": "Intelligence", "nodes": [ { "id": "h-scn", "label": "Scanner Pool", "kind": "app", "sub": "Trivy + Grype", "icon": "fa5_search" }, { "id": "h-rec", "label": "Advisory Reconciler", "kind": "app", "sub": "two feeds", "icon": "fa5_balance_scale" } ] }, { "title": "Policy plane", "nodes": [ { "id": "h-opa", "label": "Policy Bundle Service", "kind": "app", "sub": "OPA · signed", "icon": "opa" }, { "id": "h-exc", "label": "Exception Registry", "kind": "app", "sub": "all expire", "icon": "fa5_ticket_alt" } ] }, { "title": "Enforcement", "nodes": [ { "id": "h-adm", "label": "Admission Controller", "kind": "security", "sub": "p99 ≤ 150 ms", "icon": "fa5_shield_alt" }, { "id": "h-cls", "label": "Workload Clusters", "kind": "external", "sub": "400 reviews/s", "icon": "kubernetes" } ] } ], "edges": [ { "from": "h-hbr", "to": "h-scn", "label": "push event", "kind": "async" }, { "from": "h-rec", "to": "h-idx", "label": "match", "kind": "async" }, { "from": "h-adm", "to": "h-cls", "label": "allow / deny" } ], "note": "The registry stores evidence; it never stores a verdict. The verdict is computed at admission.", "meta": { "v": "1.0", "owner": "Enterprise Architecture", "date": "2026-09" } }, { "id": "03-four-planes", "title": "The Four Planes and the Load-Bearing Seam", "layout": "nested", "boxes": [ { "title": "Artifact plane — bytes, never verdicts", "kind": "boundary", "dir": "row", "children": [ { "title": "Registry services", "kind": "plain", "nodes": [ { "id": "p-hcore", "label": "Harbor Core", "kind": "integration", "sub": "auth · quota · GC", "icon": "fa5_warehouse" }, { "id": "p-dist", "label": "Distribution", "kind": "integration", "sub": "OCI dist v2", "icon": "fa5_boxes" }, { "id": "p-cache", "label": "Proxy Cache", "kind": "integration", "sub": "per region", "icon": "pattern_cache" } ] }, { "title": "Artifact storage", "kind": "plain", "nodes": [ { "id": "p-blob", "label": "MinIO Blob Store", "kind": "store", "sub": "content addressed", "icon": "minio" }, { "id": "p-meta", "label": "Metadata Store", "kind": "store", "sub": "PostgreSQL · regional", "icon": "postgresql" } ] } ] }, { "title": "Evidence plane — the system of record", "kind": "boundary", "dir": "row", "children": [ { "title": "Authoritative", "kind": "plain", "nodes": [ { "id": "p-attn", "label": "Attestation Store", "kind": "store", "sub": "append-only DSSE", "icon": "fa5_file_contract" }, { "id": "p-rekor", "label": "Rekor Log", "kind": "security", "sub": "inclusion proofs", "icon": "fa5_scroll" }, { "id": "p-fulcio", "label": "Fulcio CA", "kind": "security", "sub": "10 min certs", "icon": "fa5_certificate" } ] }, { "title": "Derived and rebuildable", "kind": "plain", "nodes": [ { "id": "p-cidx", "label": "Component Index", "kind": "store", "sub": "rebuild ≤ 4 h", "icon": "clickhouse" }, { "id": "p-find", "label": "Findings Store", "kind": "store", "sub": "history kept 3 y", "icon": "clickhouse" } ] } ] }, { "title": "Policy plane — versioned, reviewed data", "kind": "boundary", "dir": "row", "children": [ { "title": "Authoring and build", "kind": "plain", "nodes": [ { "id": "p-prepo", "label": "Policy Repository", "kind": "external", "sub": "Rego in Git", "icon": "git" }, { "id": "p-pbld", "label": "Bundle Builder", "kind": "app", "sub": "opa build · signed", "icon": "opa" } ] }, { "title": "Registers and rehearsal", "kind": "plain", "nodes": [ { "id": "p-pexc", "label": "Exception Registry", "kind": "app", "icon": "fa5_ticket_alt" }, { "id": "p-psup", "label": "Suppression Registry", "kind": "app", "icon": "fa5_bell_slash" }, { "id": "p-pdry", "label": "Dry-Run Engine", "kind": "app", "sub": "last 24 h traffic", "icon": "fa5_flask" } ] } ] }, { "title": "Enforcement plane — one per cluster", "kind": "boundary", "dir": "row", "children": [ { "title": "In-cluster", "kind": "plain", "nodes": [ { "id": "p-adm", "label": "Admission Controller", "kind": "security", "sub": "OPA embedded", "icon": "fa5_shield_alt" }, { "id": "p-lb", "label": "Local Bundle Cache", "kind": "store", "sub": "max stale 30 min", "icon": "pattern_cache" }, { "id": "p-le", "label": "Local Evidence Cache", "kind": "store", "sub": "BoltDB", "icon": "pattern_cache" } ] } ] } ], "outside": [ { "id": "p-bld", "label": "Build Pipelines", "kind": "external", "sub": "Tekton", "icon": "fa5_hammer" }, { "id": "p-k8s", "label": "Workload Clusters", "kind": "external", "sub": "kubelet pulls blobs", "icon": "kubernetes" } ], "edges": [ { "from": "p-bld", "to": "p-dist", "label": "push by digest" }, { "from": "p-dist", "to": "p-attn", "label": "artifact event", "kind": "async" }, { "from": "p-attn", "to": "p-le", "label": "evidence feed", "kind": "async" }, { "from": "p-pbld", "to": "p-lb", "label": "bundle poll", "kind": "async" }, { "from": "p-adm", "to": "p-k8s", "label": "allow / deny" }, { "from": "p-k8s", "to": "p-cache", "label": "blob pull", "kind": "batch" } ], "note": "The registry may be unavailable without the platform losing its ability to decide.", "meta": { "v": "1.0", "owner": "Enterprise Architecture", "date": "2026-09" } }, { "id": "04-layered-architecture", "title": "Container Supply Chain — Layered Architecture", "layout": "bands", "layerHeaderWidth": 160, "bands": [ { "name": "Consumption", "nodes": [ { "id": "l-kube", "label": "kubelet + containerd", "kind": "external", "icon": "k8s_node" }, { "id": "l-argo", "label": "Argo CD", "kind": "external", "icon": "argocd" }, { "id": "l-cli", "label": "Developer CLI", "kind": "app", "icon": "fa5_terminal" }, { "id": "l-ops", "label": "Ops Console", "kind": "app", "icon": "fa5_desktop" } ] }, { "name": "Enforcement", "nodes": [ { "id": "l-adm", "label": "Admission Controller", "kind": "security", "icon": "fa5_shield_alt" }, { "id": "l-sync", "label": "Evidence Sync", "kind": "integration", "icon": "fa5_sync_alt" }, { "id": "l-lcache", "label": "Local Caches", "kind": "store", "icon": "pattern_cache" } ] }, { "name": "Policy", "nodes": [ { "id": "l-eval", "label": "OPA Evaluator", "kind": "app", "icon": "opa" }, { "id": "l-bbld", "label": "Bundle Builder", "kind": "app", "icon": "opa" }, { "id": "l-reg", "label": "Exception Registry", "kind": "app", "icon": "fa5_ticket_alt" }, { "id": "l-dry", "label": "Dry-Run Engine", "kind": "app", "icon": "fa5_flask" } ] }, { "name": "Intelligence", "nodes": [ { "id": "l-scan", "label": "Scanner Pool", "kind": "app", "icon": "fa5_search" }, { "id": "l-recon", "label": "Advisory Reconciler", "kind": "app", "icon": "fa5_balance_scale" }, { "id": "l-reeval", "label": "Re-Evaluator", "kind": "app", "icon": "fa5_sync_alt" }, { "id": "l-impact", "label": "Impact Analyser", "kind": "app", "icon": "fa5_project_diagram" } ] }, { "name": "Evidence", "nodes": [ { "id": "l-attsvc", "label": "Attestation Service", "kind": "app", "icon": "fa5_file_contract" }, { "id": "l-verif", "label": "Verifier", "kind": "security", "icon": "fa5_check_double" }, { "id": "l-index", "label": "Component Indexer", "kind": "app", "icon": "fa5_barcode" }, { "id": "l-fsvc", "label": "Findings Service", "kind": "app", "icon": "fa5_bug" } ] }, { "name": "Artifact", "nodes": [ { "id": "l-hcore", "label": "Harbor Core", "kind": "integration", "icon": "fa5_warehouse" }, { "id": "l-dist", "label": "Distribution", "kind": "integration", "icon": "fa5_boxes" }, { "id": "l-proxy", "label": "Proxy Cache", "kind": "integration", "icon": "pattern_cache" }, { "id": "l-gc", "label": "Lifecycle and GC", "kind": "app", "icon": "fa5_recycle" } ] }, { "name": "Data", "nodes": [ { "id": "l-minio", "label": "MinIO", "kind": "store", "icon": "minio" }, { "id": "l-pg", "label": "PostgreSQL", "kind": "store", "icon": "postgresql" }, { "id": "l-ch", "label": "ClickHouse", "kind": "store", "icon": "clickhouse" }, { "id": "l-kafka", "label": "Kafka", "kind": "queue", "icon": "kafka" }, { "id": "l-redis", "label": "Redis", "kind": "store", "icon": "redis" } ] }, { "name": "Platform", "nodes": [ { "id": "l-kc", "label": "Keycloak", "kind": "security", "icon": "keycloak" }, { "id": "l-spire", "label": "SPIRE", "kind": "security", "icon": "fa5_fingerprint" }, { "id": "l-vault", "label": "Vault + HSM", "kind": "security", "icon": "vault" }, { "id": "l-sig", "label": "Fulcio + Rekor", "kind": "security", "icon": "fa5_certificate" }, { "id": "l-audit", "label": "Audit Ledger", "kind": "security", "icon": "fa5_archive" } ] } ], "edges": [ { "from": "l-kube", "to": "l-adm", "label": "AdmissionReview" }, { "from": "l-adm", "to": "l-eval", "label": "in-process" }, { "from": "l-eval", "to": "l-lcache", "label": "cached input" }, { "from": "l-sync", "to": "l-kafka", "label": "subscribe", "kind": "async" }, { "from": "l-scan", "to": "l-attsvc", "label": "signed result" }, { "from": "l-attsvc", "to": "l-dist", "label": "referrers" }, { "from": "l-index", "to": "l-ch", "label": "insert" }, { "from": "l-dist", "to": "l-minio", "label": "blobs" }, { "from": "l-verif", "to": "l-sig", "label": "trust roots" } ], "note": "Dependencies point downward only. Evidence reaches the enforcement plane by subscription, not by an upward call.", "meta": { "v": "1.0", "owner": "Enterprise Architecture", "date": "2026-09" } }, { "id": "05-container-architecture", "title": "Container and Component Architecture", "layout": "nested", "boxes": [ { "title": "Artifact plane", "kind": "boundary", "dir": "row", "children": [ { "title": "Harbor", "kind": "plain", "nodes": [ { "id": "c-core", "label": "harbor-core", "kind": "integration", "sub": "Go · 6 replicas", "icon": "fa5_warehouse" }, { "id": "c-reg", "label": "harbor-registry", "kind": "integration", "sub": "distribution · 8", "icon": "fa5_boxes" }, { "id": "c-job", "label": "harbor-jobservice", "kind": "app", "sub": "GC · replication · 4", "icon": "fa5_recycle" }, { "id": "c-prox", "label": "harbor-proxy-cache", "kind": "integration", "sub": "1 per region", "icon": "pattern_cache" } ] }, { "title": "Artifact state", "kind": "plain", "nodes": [ { "id": "c-minio", "label": "MinIO", "kind": "store", "sub": "12 nodes · EC 8+4", "icon": "minio" }, { "id": "c-pg", "label": "PostgreSQL", "kind": "store", "sub": "Patroni · 3 nodes", "icon": "postgresql" }, { "id": "c-redis", "label": "Redis", "kind": "store", "sub": "sentinel · 3", "icon": "redis" } ] } ] }, { "title": "Evidence plane", "kind": "boundary", "dir": "row", "children": [ { "title": "Evidence services", "kind": "plain", "nodes": [ { "id": "c-att", "label": "attestation-api", "kind": "app", "sub": "Go · gRPC · 6", "icon": "fa5_file_contract" }, { "id": "c-ver", "label": "verifier", "kind": "security", "sub": "Go · 4", "icon": "fa5_check_double" }, { "id": "c-idx", "label": "indexer", "kind": "app", "sub": "Go · 8 workers", "icon": "fa5_barcode" }, { "id": "c-fnd", "label": "findings-api", "kind": "app", "sub": "Go · 4", "icon": "fa5_bug" } ] }, { "title": "Sigstore", "kind": "plain", "nodes": [ { "id": "c-ful", "label": "Fulcio", "kind": "security", "sub": "private CA · 3", "icon": "fa5_certificate" }, { "id": "c-rek", "label": "Rekor", "kind": "security", "sub": "Trillian · 3", "icon": "fa5_scroll" }, { "id": "c-tuf", "label": "TUF Repository", "kind": "security", "sub": "root of trust", "icon": "fa5_key" } ] }, { "title": "Evidence state", "kind": "plain", "nodes": [ { "id": "c-ch", "label": "ClickHouse", "kind": "store", "sub": "6 shards × 2", "icon": "clickhouse" }, { "id": "c-kaf", "label": "Kafka", "kind": "queue", "sub": "Strimzi · 5 brokers", "icon": "kafka" } ] } ] }, { "title": "Policy plane", "kind": "boundary", "dir": "row", "children": [ { "title": "Policy services", "kind": "plain", "nodes": [ { "id": "c-bb", "label": "bundle-builder", "kind": "app", "sub": "opa build · CI job", "icon": "opa" }, { "id": "c-pol", "label": "policy-api", "kind": "app", "sub": "Go · 4", "icon": "opa" }, { "id": "c-exc", "label": "exception-api", "kind": "app", "sub": "Go · 2", "icon": "fa5_ticket_alt" }, { "id": "c-dry", "label": "dryrun-runner", "kind": "app", "sub": "batch job", "icon": "fa5_flask" } ] } ] }, { "title": "Enforcement plane — replicated into every workload cluster", "kind": "boundary", "dir": "row", "children": [ { "title": "Cluster add-on", "kind": "plain", "nodes": [ { "id": "c-adm", "label": "admission-webhook", "kind": "security", "sub": "Go + OPA · 3", "icon": "fa5_shield_alt" }, { "id": "c-esync", "label": "evidence-sync", "kind": "integration", "sub": "Kafka consumer · 2", "icon": "fa5_sync_alt" }, { "id": "c-bolt", "label": "local cache", "kind": "store", "sub": "BoltDB on PVC", "icon": "pattern_cache" } ] } ] } ], "outside": [ { "id": "c-tkn", "label": "Tekton", "kind": "external", "sub": "build identity", "icon": "fa5_hammer" }, { "id": "c-kc", "label": "Keycloak", "kind": "external", "sub": "human OIDC", "icon": "keycloak" }, { "id": "c-spire", "label": "SPIRE", "kind": "external", "sub": "workload SVID", "icon": "fa5_fingerprint" }, { "id": "c-vault", "label": "Vault + HSM", "kind": "external", "sub": "PKCS#11", "icon": "vault" } ], "edges": [ { "from": "c-tkn", "to": "c-reg", "label": "push + referrers" }, { "from": "c-core", "to": "c-kaf", "label": "artifact events", "kind": "async" }, { "from": "c-att", "to": "c-minio", "label": "DSSE bytes" }, { "from": "c-idx", "to": "c-ch", "label": "component rows" }, { "from": "c-esync", "to": "c-kaf", "label": "evidence topic", "kind": "async" }, { "from": "c-adm", "to": "c-bolt", "label": "local read" }, { "from": "c-ful", "to": "c-vault", "label": "CA key" } ], "note": "Replica counts are sized for 400 admission reviews/s per cluster and 2,500 builds on a release day.", "meta": { "v": "1.0", "owner": "Platform Engineering", "date": "2026-09" } }, { "id": "06-integration-architecture", "title": "Integration and Interface Catalogue", "layout": "hub", "left": { "title": "Producers and consumers", "nodes": [ { "id": "n-tkn", "label": "Tekton Builders", "kind": "external", "rel": "OCI dist v2 · push" }, { "id": "n-argo", "label": "Argo CD", "kind": "external", "rel": "digest resolve", "icon": "argocd" }, { "id": "n-cli", "label": "Developer CLI", "kind": "app", "rel": "cosign · oras", "icon": "fa5_terminal" }, { "id": "n-adm", "label": "Admission Controllers", "kind": "security", "rel": "gRPC · evidence", "icon": "fa5_shield_alt" }, { "id": "n-ops", "label": "Ops Console", "kind": "app", "rel": "REST · read only", "icon": "fa5_desktop" } ] }, "centre": { "title": "Platform interfaces", "nodes": [ { "id": "n-hbr", "label": "Harbor API", "kind": "integration", "sub": "dist v2 + referrers", "icon": "fa5_warehouse" }, { "id": "n-ev", "label": "Evidence API", "kind": "integration", "sub": "gRPC · 5 methods", "icon": "fa5_file_contract" }, { "id": "n-pol", "label": "Policy Bundle Server", "kind": "integration", "sub": "signed OCI bundle", "icon": "opa" }, { "id": "n-bus", "label": "Kafka Event Bus", "kind": "queue", "sub": "6 topics", "icon": "kafka" } ] }, "right": { "title": "Dependencies", "nodes": [ { "id": "n-git", "label": "GitLab", "kind": "external", "rel": "revision check", "dir": "out", "icon": "gitlab" }, { "id": "n-kc", "label": "Keycloak", "kind": "external", "rel": "OIDC discovery", "dir": "out", "icon": "keycloak" }, { "id": "n-spire", "label": "SPIRE Server", "kind": "external", "rel": "SVID validation", "dir": "out", "icon": "fa5_fingerprint" }, { "id": "n-vault", "label": "Vault + HSM", "kind": "external", "rel": "PKCS#11 sign", "dir": "out", "icon": "vault" }, { "id": "n-osv", "label": "OSV Mirror", "kind": "external", "rel": "15 min poll", "dir": "out", "kind2": "batch", "icon": "external_feed" }, { "id": "n-nvd", "label": "Distro and NVD Mirror", "kind": "external", "rel": "hourly", "dir": "out", "kind2": "batch", "icon": "external_feed" }, { "id": "n-ups", "label": "Upstream Registries", "kind": "external", "rel": "proxy pull", "dir": "out", "icon": "fa5_warehouse" }, { "id": "n-aud", "label": "Audit Ledger", "kind": "security", "rel": "append only", "dir": "out", "kind2": "async", "icon": "fa5_archive" } ] }, "note": "Every interface is owned by the platform except the upstream registry and advisory feed contracts.", "meta": { "v": "1.0", "owner": "Integration Architecture", "date": "2026-09" } }, { "id": "07-artifact-and-referrers-model", "title": "OCI Artifact Model — Digest, Tags and Referrers", "layout": "nested", "boxes": [ { "title": "Repository apps/checkout · release class, tags immutable", "kind": "boundary", "dir": "col", "children": [ { "title": "Tags — pointers, never identity", "kind": "plain", "nodes": [ { "id": "t-rel", "label": "2026.09.1", "kind": "integration", "sub": "immutable", "icon": "fa5_tag" }, { "id": "t-lat", "label": "latest", "kind": "integration", "sub": "mutable · dev only", "icon": "fa5_tag" }, { "id": "t-hist", "label": "Tag History", "kind": "store", "sub": "actor + timestamp", "icon": "fa5_history" } ] }, { "title": "Digest — the identity", "kind": "plain", "nodes": [ { "id": "t-idx", "label": "sha256:9f3c…", "kind": "app", "sub": "image index", "icon": "fa5_fingerprint" }, { "id": "t-man", "label": "Manifest amd64", "kind": "app", "icon": "fa5_file_code" }, { "id": "t-cfg", "label": "Config Blob", "kind": "store", "icon": "fa5_file_code" }, { "id": "t-lay", "label": "Layer Blobs × 7", "kind": "store", "sub": "shared across images", "icon": "minio" } ] } ] }, { "title": "Evidence attached to the digest by the referrers relationship", "kind": "boundary", "dir": "row", "children": [ { "title": "Origin", "kind": "plain", "nodes": [ { "id": "t-prov", "label": "SLSA Provenance", "kind": "security", "sub": "in-toto predicate", "icon": "fa5_stamp" }, { "id": "t-lin", "label": "Base Image Lineage", "kind": "security", "sub": "layer composition", "icon": "fa5_project_diagram" } ] }, { "title": "Contents", "kind": "plain", "nodes": [ { "id": "t-sbom", "label": "CycloneDX SBOM", "kind": "security", "sub": "1,800 components", "icon": "fa5_clipboard_list" }, { "id": "t-vex", "label": "Scan Result", "kind": "security", "sub": "OpenVEX" } ] }, { "title": "Verification and lifecycle", "kind": "plain", "nodes": [ { "id": "t-sig", "label": "Cosign Signature", "kind": "security", "sub": "DSSE envelope", "icon": "fa5_signature" }, { "id": "t-inc", "label": "Inclusion Proof", "kind": "security", "sub": "Rekor SET", "icon": "fa5_check_double" }, { "id": "t-pro", "label": "Promotion Attestation", "kind": "security", "sub": "stage → prod", "icon": "fa5_stamp" } ] } ] } ], "outside": [ { "id": "t-api", "label": "Referrers API", "kind": "integration", "sub": "GET /v2/…/referrers", "icon": "fa5_sitemap" }, { "id": "t-guard", "label": "GC Reference Guard", "kind": "app", "sub": "running set + retained", "icon": "fa5_lock" } ], "edges": [ { "from": "t-rel", "to": "t-idx", "label": "pointer only" }, { "from": "t-hist", "to": "t-idx", "label": "resolved digests" }, { "from": "t-prov", "to": "t-idx", "label": "subject digest" }, { "from": "t-sig", "to": "t-idx", "label": "subject digest" }, { "from": "t-api", "to": "t-idx", "label": "lists evidence" }, { "from": "t-guard", "to": "t-lay", "label": "never collect", "kind": "error" } ], "note": "A provenance document whose subject digest is absent from the registry is rejected on receipt.", "meta": { "v": "1.0", "owner": "Platform Engineering", "date": "2026-09" } }, { "id": "08-evidence-plane-pipeline", "title": "Evidence Plane — Receive, Verify, Persist, Derive", "layout": "flow", "chain": true, "canvas": { "width": 1780 }, "nodeWidth": 195, "stages": [ { "title": "Receive", "nodes": [ { "id": "e-api", "label": "Attestation API", "kind": "integration", "sub": "DSSE envelope", "icon": "fa5_file_contract" }, { "id": "e-evt", "label": "Artifact Event Consumer", "kind": "integration", "sub": "Harbor webhook" } ] }, { "title": "Verify on receipt", "nodes": [ { "id": "e-subj", "label": "Subject in registry?", "kind": "decision" }, { "id": "e-ident", "label": "Signer identity", "kind": "decision", "sub": "workload, not human" }, { "id": "e-src", "label": "Source allowlisted?", "kind": "decision" } ] }, { "title": "Persist — authoritative", "nodes": [ { "id": "e-worm", "label": "Attestation Store", "kind": "store", "sub": "MinIO object lock", "icon": "fa5_file_contract" }, { "id": "e-led", "label": "Append-Only Ledger", "kind": "store", "sub": "PostgreSQL · hash chain", "icon": "postgresql" }, { "id": "e-rek", "label": "Rekor Entry", "kind": "security", "sub": "inclusion proof", "icon": "fa5_scroll" } ] }, { "title": "Derive — rebuildable", "nodes": [ { "id": "e-cidx", "label": "Component Indexer", "kind": "app", "sub": "purl rows", "icon": "fa5_barcode" }, { "id": "e-fpr", "label": "Findings Projector", "kind": "app", "icon": "fa5_bug" }, { "id": "e-vin", "label": "Verdict Input Builder", "kind": "app", "sub": "per digest", "icon": "fa5_file_contract" } ] }, { "title": "Serve", "nodes": [ { "id": "e-esvc", "label": "Evidence API", "kind": "integration", "sub": "p99 ≤ 40 ms", "icon": "fa5_file_contract" }, { "id": "e-ref", "label": "Referrers Passthrough", "kind": "integration", "icon": "fa5_sitemap" } ] }, { "title": "Replicate", "nodes": [ { "id": "e-topic", "label": "Evidence Topic", "kind": "queue", "sub": "ordered per subject", "icon": "kafka" }, { "id": "e-reg", "label": "Regional Replicas", "kind": "store", "sub": "async · ordered", "icon": "fa5_globe" }, { "id": "e-edge", "label": "Edge Caches", "kind": "store", "sub": "one per cluster", "icon": "pattern_cache" } ] } ], "edges": [ { "from": "e-subj", "to": "e-api", "label": "reject: no subject", "kind": "error", "route": "gutter" }, { "from": "e-worm", "to": "e-topic", "label": "publish", "kind": "async" } ], "note": "A correction is a new record that supersedes; no record is ever updated in place.", "meta": { "v": "1.0", "owner": "Platform Engineering", "date": "2026-09" } }, { "id": "09-policy-bundle-lifecycle", "title": "Policy Bundle Lifecycle — Policy as Reviewed Data", "layout": "cycle", "centre": { "label": "Policy Bundle", "sub": "versioned · signed", "icon": "opa" }, "nodes": [ { "id": "y-auth", "label": "Author", "kind": "app", "sub": "Rego in Git", "icon": "git" }, { "id": "y-rev", "label": "Review", "kind": "decision", "sub": "2 approvers" }, { "id": "y-bld", "label": "Build and Test", "kind": "app", "sub": "opa build · conftest", "icon": "opa" }, { "id": "y-dry", "label": "Dry Run", "kind": "app", "sub": "last 24 h traffic", "icon": "fa5_flask" }, { "id": "y-sign", "label": "Sign and Publish", "kind": "security", "sub": "OCI bundle", "icon": "fa5_signature" }, { "id": "y-dist", "label": "Distribute", "kind": "integration", "sub": "p95 ≤ 5 min", "icon": "fa5_broadcast_tower" }, { "id": "y-obs", "label": "Enforce and Observe", "kind": "platform", "sub": "decision logs", "icon": "fa5_chart_line" } ], "ringLabels": [ "merge request", "approved", "bundle candidate", "impact report", "signed artifact", "at every cluster", "telemetry back" ], "note": "A bundle that would have denied more than 2% of the last 24 h requires an explicit override.", "meta": { "v": "1.0", "owner": "Security Architecture", "date": "2026-09" } }, { "id": "10-data-architecture", "title": "Data Architecture — Authoritative, Regional, Derived", "layout": "nested", "boxes": [ { "title": "Authoritative — the system of record, never derived from anything else", "kind": "boundary", "dir": "row", "children": [ { "title": "Evidence", "kind": "plain", "nodes": [ { "id": "d-att", "label": "Attestation Store", "kind": "store", "sub": "object lock · 7 y", "icon": "fa5_file_contract" }, { "id": "d-led", "label": "Append-Only Ledger", "kind": "store", "sub": "hash chained · 7 y", "icon": "postgresql" }, { "id": "d-rek", "label": "Rekor Log", "kind": "security", "sub": "inclusion proofs · 7 y", "icon": "fa5_scroll" } ] }, { "title": "Artifact bytes", "kind": "plain", "nodes": [ { "id": "d-blob", "label": "Layer Blobs", "kind": "store", "sub": "MinIO EC 8+4 · 14 TB", "icon": "minio" }, { "id": "d-man", "label": "Manifests", "kind": "store", "sub": "content addressed", "icon": "minio" } ] }, { "title": "Audit", "kind": "plain", "nodes": [ { "id": "d-aud", "label": "Audit Ledger", "kind": "security", "sub": "immudb · 7 y", "icon": "fa5_archive" } ] } ] }, { "title": "Regional and strongly consistent — one write region per repository", "kind": "boundary", "dir": "row", "children": [ { "title": "Registry metadata", "kind": "plain", "nodes": [ { "id": "d-repo", "label": "Repositories and Manifests", "kind": "store", "sub": "PostgreSQL", "icon": "postgresql" }, { "id": "d-tag", "label": "Tag History", "kind": "store", "sub": "append rows only", "icon": "fa5_history" }, { "id": "d-prom", "label": "Promotion State", "kind": "store", "sub": "projection of evidence", "icon": "postgresql" } ] } ] }, { "title": "Derived — may be destroyed and rebuilt", "kind": "boundary", "dir": "row", "children": [ { "title": "Indexes", "kind": "plain", "nodes": [ { "id": "d-cidx", "label": "Component Index", "kind": "store", "sub": "rebuild ≤ 4 h", "icon": "clickhouse" }, { "id": "d-find", "label": "Findings Store", "kind": "store", "sub": "history 3 y", "icon": "clickhouse" } ] }, { "title": "Caches", "kind": "plain", "nodes": [ { "id": "d-vin", "label": "Verdict Input Cache", "kind": "store", "sub": "BoltDB per cluster", "icon": "pattern_cache" }, { "id": "d-root", "label": "Trust Root Cache", "kind": "store", "sub": "TUF · 30 d offline", "icon": "fa5_key" }, { "id": "d-lsc", "label": "Layer Scan Cache", "kind": "store", "sub": "Redis · by layer digest", "icon": "redis" } ] } ] } ], "outside": [ { "id": "d-bak", "label": "Backup Target", "kind": "store", "sub": "offline object lock", "icon": "fa5_archive" } ], "edges": [ { "from": "d-att", "to": "d-cidx", "label": "rebuild source", "kind": "batch" }, { "from": "d-att", "to": "d-bak", "label": "RPO ≤ 1 min", "kind": "async" }, { "from": "d-repo", "to": "d-bak", "label": "RPO ≤ 5 min", "kind": "async" }, { "from": "d-blob", "to": "d-bak", "label": "RPO ≤ 15 min", "kind": "batch" } ], "note": "Loss of the metadata store or the component index is a rebuild, not a data loss.", "meta": { "v": "1.0", "owner": "Data Architecture", "date": "2026-09" } }, { "id": "11-evidence-data-model", "title": "Evidence Data Model", "layout": "er", "canvas": { "width": 1680, "cols": 4 }, "rowGap": 250, "entities": [ { "id": "m-repo", "name": "repository", "kind": "store", "row": 0, "col": 0, "attrs": [ "repository_id PK", "project FK -> tenant", "class release|dev", "quota_bytes", "immutable_tags" ] }, { "id": "m-art", "name": "artifact", "kind": "store", "row": 0, "col": 1, "attrs": [ "digest PK sha256", "repository_id FK", "media_type", "size_bytes", "first_pushed_at" ] }, { "id": "m-att", "name": "attestation", "kind": "store", "row": 0, "col": 2, "attrs": [ "attestation_id PK", "subject_digest FK", "predicate_type", "generator", "superseded_by" ] }, { "id": "m-sig", "name": "signature", "kind": "store", "row": 0, "col": 3, "attrs": [ "signature_id PK", "attestation_id FK", "signer_identity", "issuer", "cert_not_after" ] }, { "id": "m-tag", "name": "tag_history", "kind": "store", "row": 1, "col": 0, "attrs": [ "tag_event_id PK", "repository_id FK", "tag", "digest FK", "actor", "occurred_at" ] }, { "id": "m-comp", "name": "sbom_component", "kind": "store", "row": 1, "col": 1, "attrs": [ "component_id PK", "subject_digest FK", "purl", "version", "licence", "layer_digest" ] }, { "id": "m-pro", "name": "promotion", "kind": "store", "row": 1, "col": 2, "attrs": [ "promotion_id PK", "attestation_id FK", "from_env", "to_env", "approver", "bundle_version" ] }, { "id": "m-inc", "name": "inclusion_proof", "kind": "store", "row": 1, "col": 3, "attrs": [ "proof_id PK", "signature_id FK", "log_index", "tree_size", "signed_entry_ts" ] }, { "id": "m-find", "name": "finding", "kind": "store", "row": 2, "col": 1, "attrs": [ "finding_id PK", "subject_digest FK", "component_id FK", "advisory_id FK", "severity", "state", "first_observed_at" ] }, { "id": "m-adv", "name": "advisory", "kind": "store", "row": 2, "col": 2, "attrs": [ "advisory_id PK CVE|GHSA", "feed_agreement", "severity_osv", "severity_distro", "amended_at" ] }, { "id": "m-bun", "name": "policy_bundle", "kind": "store", "row": 2, "col": 3, "attrs": [ "bundle_version PK", "environment", "rego_digest", "signed_by", "effective_from" ] }, { "id": "m-sup", "name": "suppression", "kind": "store", "row": 3, "col": 1, "attrs": [ "suppression_id PK", "finding_id FK", "justification", "approver", "expires_at NOT NULL" ] }, { "id": "m-exc", "name": "exception", "kind": "store", "row": 3, "col": 2, "attrs": [ "exception_id PK", "scope", "owner", "justification", "expires_at NOT NULL" ] }, { "id": "m-dec", "name": "admission_decision", "kind": "store", "row": 3, "col": 3, "attrs": [ "decision_id PK", "subject_digest", "bundle_version FK", "verdict", "reason_codes", "evidence_digests" ] } ], "relations": [ { "from": "m-repo", "to": "m-art", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "m-repo", "to": "m-tag", "label": "1 : N", "from_side": "s", "to_side": "n1" }, { "from": "m-art", "to": "m-tag", "label": "N : 1", "from_side": "s1", "to_side": "n3" }, { "from": "m-art", "to": "m-att", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "m-att", "to": "m-sig", "label": "1 : 1", "from_side": "e", "to_side": "w" }, { "from": "m-sig", "to": "m-inc", "label": "1 : 1", "from_side": "s", "to_side": "n" }, { "from": "m-att", "to": "m-pro", "label": "subtype", "from_side": "s", "to_side": "n" }, { "from": "m-art", "to": "m-comp", "label": "1 : N", "from_side": "s3", "to_side": "n" }, { "from": "m-comp", "to": "m-find", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "m-adv", "to": "m-find", "label": "1 : N", "from_side": "w", "to_side": "e" }, { "from": "m-find", "to": "m-sup", "label": "0 : N", "from_side": "s", "to_side": "n", "kind": "optional" }, { "from": "m-bun", "to": "m-dec", "label": "1 : N", "from_side": "s3", "to_side": "n" }, { "from": "m-bun", "to": "m-exc", "label": "1 : N", "from_side": "s1", "to_side": "e" } ], "note": "expires_at is NOT NULL on both suppression and exception. A grant without an expiry cannot be written.", "meta": { "v": "1.0", "owner": "Data Architecture", "date": "2026-09" } }, { "id": "12-supply-chain-data-flow", "title": "Supply Chain Data Flow and Cadence", "layout": "flow", "chain": true, "canvas": { "width": 1780 }, "nodeWidth": 195, "stages": [ { "title": "Produce", "nodes": [ { "id": "f-src", "label": "Source Commit", "kind": "external", "sub": "GitLab revision", "icon": "git" }, { "id": "f-base", "label": "Base Image", "kind": "external", "sub": "hardened, attested", "icon": "fa5_layer_group" }, { "id": "f-img", "label": "Built Image", "kind": "app", "sub": "900–2,500 / day", "icon": "docker" } ] }, { "title": "Land", "nodes": [ { "id": "f-blob", "label": "Blob Store", "kind": "store", "sub": "write once", "icon": "minio" }, { "id": "f-meta", "label": "Manifest and Tag", "kind": "store", "sub": "strongly consistent", "icon": "postgresql" } ] }, { "title": "Attest", "nodes": [ { "id": "f-prov", "label": "Provenance", "kind": "security", "sub": "at build time", "icon": "fa5_stamp" }, { "id": "f-sbom", "label": "SBOM", "kind": "security", "sub": "~90 MB / day", "icon": "fa5_clipboard_list" }, { "id": "f-scan", "label": "Scan Result", "kind": "security", "sub": "p95 ≤ 10 min" }, { "id": "f-sig", "label": "Signature", "kind": "security", "sub": "before promotion", "icon": "fa5_signature" } ] }, { "title": "Index", "nodes": [ { "id": "f-cidx", "label": "Component Rows", "kind": "store", "sub": "1,800 per SBOM", "icon": "clickhouse" }, { "id": "f-find", "label": "Finding Set", "kind": "store", "sub": "per digest", "icon": "clickhouse" }, { "id": "f-vin", "label": "Verdict Inputs", "kind": "store", "sub": "compact per digest", "icon": "fa5_file_contract" } ] }, { "title": "Decide", "nodes": [ { "id": "f-feed", "label": "Evidence Feed", "kind": "queue", "sub": "ordered per subject", "icon": "kafka" }, { "id": "f-edge", "label": "Edge Cache", "kind": "store", "sub": "≤ 30 min stale", "icon": "pattern_cache" }, { "id": "f-dec", "label": "Admission Decision", "kind": "security", "sub": "computed, not stored", "icon": "fa5_shield_alt" } ] }, { "title": "Retain", "nodes": [ { "id": "f-aud", "label": "Audit Records", "kind": "security", "sub": "7 years", "icon": "fa5_archive" }, { "id": "f-hist", "label": "Finding History", "kind": "store", "sub": "3 years, never deleted", "icon": "clickhouse" }, { "id": "f-exp", "label": "Lifecycle Expiry", "kind": "app", "sub": "dev untagged 30 d", "icon": "fa5_recycle" } ] } ], "edges": [ { "from": "f-scan", "to": "f-find", "label": "on push and on advisory", "kind": "async" }, { "from": "f-dec", "to": "f-aud", "label": "every decision", "kind": "async" } ], "note": "Findings are recomputed when advisories move, not only when an image is pushed.", "meta": { "v": "1.0", "owner": "Data Architecture", "date": "2026-09" } }, { "id": "13-component-index", "title": "Component Index — Partitioning and Determination", "layout": "grid", "columns": [ "Cataloguer", "Index key", "Partition", "Determination", "Advisory source" ], "rows": [ { "title": "OS packages", "cells": [ [ { "id": "g-os1", "label": "Syft OS cataloguer", "kind": "app", "icon": "fa5_clipboard_list" } ], [ { "id": "g-os2", "label": "pkg:deb · rpm · apk", "kind": "store", "icon": "fa5_barcode" } ], [ { "id": "g-os3", "label": "by ecosystem", "kind": "store" } ], [ { "id": "g-os4", "label": "present only", "kind": "decision" } ], [ { "id": "g-os5", "label": "Distro feed + OSV", "kind": "external", "icon": "external_feed" } ] ] }, { "title": "Go modules", "cells": [ [ { "id": "g-go1", "label": "Syft go-module", "kind": "app", "icon": "fa5_clipboard_list" } ], [ { "id": "g-go2", "label": "pkg:golang", "kind": "store", "icon": "fa5_barcode" } ], [ { "id": "g-go3", "label": "ecosystem + prefix", "kind": "store" } ], [ { "id": "g-go4", "label": "reachable", "kind": "decision", "sub": "call graph" } ], [ { "id": "g-go5", "label": "OSV Go", "kind": "external", "icon": "external_feed" } ] ] }, { "title": "npm", "cells": [ [ { "id": "g-np1", "label": "Syft javascript", "kind": "app", "icon": "fa5_clipboard_list" } ], [ { "id": "g-np2", "label": "pkg:npm", "kind": "store", "icon": "fa5_barcode" } ], [ { "id": "g-np3", "label": "ecosystem + scope", "kind": "store" } ], [ { "id": "g-np4", "label": "reachable", "kind": "decision", "sub": "import graph" } ], [ { "id": "g-np5", "label": "OSV + GHSA", "kind": "external", "icon": "external_feed" } ] ] }, { "title": "Java", "cells": [ [ { "id": "g-jv1", "label": "Syft java-archive", "kind": "app", "icon": "fa5_clipboard_list" } ], [ { "id": "g-jv2", "label": "pkg:maven", "kind": "store", "icon": "fa5_barcode" } ], [ { "id": "g-jv3", "label": "ecosystem + groupId", "kind": "store" } ], [ { "id": "g-jv4", "label": "present only", "kind": "decision", "sub": "phase 3" } ], [ { "id": "g-jv5", "label": "OSV + GHSA", "kind": "external", "icon": "external_feed" } ] ] }, { "title": "Python", "cells": [ [ { "id": "g-py1", "label": "Syft python", "kind": "app", "icon": "fa5_clipboard_list" } ], [ { "id": "g-py2", "label": "pkg:pypi", "kind": "store", "icon": "fa5_barcode" } ], [ { "id": "g-py3", "label": "ecosystem + prefix", "kind": "store" } ], [ { "id": "g-py4", "label": "reachable", "kind": "decision", "sub": "import graph" } ], [ { "id": "g-py5", "label": "OSV PyPI", "kind": "external", "icon": "external_feed" } ] ] }, { "title": "Base layers", "cells": [ [ { "id": "g-bl1", "label": "Layer cataloguer", "kind": "app", "icon": "fa5_clipboard_list" } ], [ { "id": "g-bl2", "label": "layer digest", "kind": "store", "icon": "fa5_barcode" } ], [ { "id": "g-bl3", "label": "by layer digest", "kind": "store" } ], [ { "id": "g-bl4", "label": "inherited", "kind": "decision", "sub": "fan out to derived" } ], [ { "id": "g-bl5", "label": "same as OS row", "kind": "external", "icon": "external_feed" } ] ] } ], "note": "Every row is rebuildable by replaying SBOM attestations. Full rebuild budget: 4 hours.", "meta": { "v": "1.0", "owner": "Data Architecture", "date": "2026-09" } }, { "id": "14-multi-region-topology", "title": "Multi-Region Topology — Replicate, Cache, Isolate", "layout": "nested", "boxes": [ { "title": "DC-1 — write region for this repository set", "kind": "onprem", "dir": "row", "children": [ { "title": "Artifact plane", "kind": "plain", "nodes": [ { "id": "r-h1", "label": "Harbor Origin", "kind": "integration", "sub": "push accepted here", "icon": "fa5_warehouse" }, { "id": "r-m1", "label": "MinIO Primary", "kind": "store", "sub": "14 TB", "icon": "minio" } ] }, { "title": "Evidence plane", "kind": "plain", "nodes": [ { "id": "r-e1", "label": "Attestation Store", "kind": "store", "sub": "primary", "icon": "fa5_file_contract" }, { "id": "r-k1", "label": "Evidence Topic", "kind": "queue", "sub": "ordered per subject", "icon": "kafka" }, { "id": "r-rk1", "label": "Rekor", "kind": "security", "icon": "fa5_scroll" } ] }, { "title": "Metadata", "kind": "plain", "nodes": [ { "id": "r-p1", "label": "PostgreSQL Primary", "kind": "store", "sub": "regional writes", "icon": "postgresql" } ] } ] }, { "title": "DC-2 — read region", "kind": "onprem", "dir": "row", "children": [ { "title": "Artifact plane", "kind": "plain", "nodes": [ { "id": "r-h2", "label": "Proxy Cache", "kind": "integration", "sub": "absorbs pull storms", "icon": "pattern_cache" }, { "id": "r-m2", "label": "MinIO Replica", "kind": "store", "sub": "async · RPO 15 min", "icon": "minio" } ] }, { "title": "Evidence plane", "kind": "plain", "nodes": [ { "id": "r-e2", "label": "Evidence Replica", "kind": "store", "sub": "ordered per subject", "icon": "fa5_file_contract" }, { "id": "r-lag", "label": "Unreplicated Evidence", "kind": "risk", "sub": "deny, retryable" } ] }, { "title": "Metadata", "kind": "plain", "nodes": [ { "id": "r-p2", "label": "PostgreSQL Replica", "kind": "store", "sub": "read only", "icon": "postgresql" } ] } ] }, { "title": "Edge and air-gapped sites", "kind": "onprem", "dir": "row", "children": [ { "title": "Offline island", "kind": "plain", "nodes": [ { "id": "r-zot", "label": "Local Registry", "kind": "integration", "sub": "zot · seeded", "icon": "fa5_warehouse" }, { "id": "r-bun", "label": "Evidence Bundle", "kind": "store", "sub": "signed · transported", "icon": "fa5_file_contract" }, { "id": "r-tuf", "label": "Offline Trust Root", "kind": "security", "sub": "TUF · 30 d validity", "icon": "fa5_key" } ] } ] } ], "outside": [ { "id": "r-c1", "label": "Clusters in DC-1", "kind": "external", "icon": "kubernetes" }, { "id": "r-c2", "label": "Clusters in DC-2", "kind": "external", "icon": "kubernetes" }, { "id": "r-c3", "label": "Edge Clusters", "kind": "external", "icon": "kubernetes" } ], "edges": [ { "from": "r-m1", "to": "r-m2", "label": "async blobs", "kind": "batch" }, { "from": "r-k1", "to": "r-e2", "label": "ordered replication", "kind": "async" }, { "from": "r-p1", "to": "r-p2", "label": "streaming", "kind": "async" }, { "from": "r-e2", "to": "r-c2", "label": "regional read", "route": "gutter" }, { "from": "r-bun", "to": "r-zot", "label": "signed transfer", "kind": "batch" } ], "note": "Admission in a region reads evidence from that region. Adding a region changes no trust relationship.", "meta": { "v": "1.0", "owner": "Enterprise Architecture", "date": "2026-09" } }, { "id": "15-build-and-attest-sequence", "title": "Build to Attested Push — Critical Flow", "layout": "sequence", "lifelines": [ { "id": "q-git", "label": "GitLab", "kind": "external", "icon": "gitlab" }, { "id": "q-tkn", "label": "Tekton Pipeline", "kind": "app", "icon": "fa5_hammer" }, { "id": "q-spire", "label": "SPIRE", "kind": "security", "icon": "fa5_fingerprint" }, { "id": "q-ful", "label": "Fulcio", "kind": "security", "icon": "fa5_certificate" }, { "id": "q-hbr", "label": "Harbor", "kind": "integration", "icon": "fa5_warehouse" }, { "id": "q-rek", "label": "Rekor", "kind": "security", "icon": "fa5_scroll" }, { "id": "q-att", "label": "Attestation Service", "kind": "app", "icon": "fa5_file_contract" } ], "messages": [ { "from": "q-git", "to": "q-tkn", "label": "push event · rev abc123f", "kind": "call" }, { "from": "q-tkn", "to": "q-spire", "label": "node + workload attest", "kind": "call" }, { "from": "q-spire", "to": "q-tkn", "label": "JWT-SVID · 5 min", "kind": "return" }, { "from": "q-tkn", "to": "q-tkn", "label": "build from pinned base", "kind": "self" }, { "from": "q-tkn", "to": "q-hbr", "label": "push image", "kind": "call" }, { "from": "q-hbr", "to": "q-tkn", "label": "sha256:9f3c…", "kind": "return", "icon": "fa5_fingerprint" }, { "from": "q-tkn", "to": "q-tkn", "label": "syft → CycloneDX SBOM", "kind": "self" }, { "from": "q-tkn", "to": "q-ful", "label": "SVID → signing cert", "kind": "call" }, { "from": "q-ful", "to": "q-tkn", "label": "cert · 10 min validity", "kind": "return" }, { "from": "q-tkn", "to": "q-rek", "label": "log DSSE entries", "kind": "call" }, { "from": "q-rek", "to": "q-tkn", "label": "inclusion proof", "kind": "return" }, { "from": "q-tkn", "to": "q-hbr", "label": "push referrers", "kind": "call" }, { "from": "q-hbr", "to": "q-att", "label": "artifact event", "kind": "async" }, { "from": "q-att", "to": "q-att", "label": "verify subject and signer", "kind": "self" }, { "from": "q-att", "to": "q-tkn", "label": "reject: human credential", "kind": "error" } ], "note": "Provenance signed by a developer's personal credential is refused at receipt, not at admission.", "meta": { "v": "1.0", "owner": "Platform Engineering", "date": "2026-09" } }, { "id": "16-scan-pipeline", "title": "Scan Pipeline — Deduplicated and Prioritised", "layout": "flow", "chain": true, "canvas": { "width": 1800 }, "nodeWidth": 190, "stages": [ { "title": "Trigger", "nodes": [ { "id": "s-push", "label": "Push Event", "kind": "queue", "sub": "on every artifact" }, { "id": "s-adv", "label": "Advisory Change", "kind": "queue", "sub": "feed driven" }, { "id": "s-sch", "label": "Scheduled Recheck", "kind": "app", "sub": "weekly floor", "icon": "fa5_clock" } ] }, { "title": "Deduplicate", "nodes": [ { "id": "s-lc", "label": "Layer Digest Cache", "kind": "store", "sub": "Redis", "icon": "redis" }, { "id": "s-new", "label": "New layers only?", "kind": "decision" } ] }, { "title": "Prioritise", "nodes": [ { "id": "s-qp", "label": "Production Queue", "kind": "queue", "sub": "served first" }, { "id": "s-qs", "label": "Staging Queue", "kind": "queue" }, { "id": "s-qd", "label": "Development Queue", "kind": "queue", "sub": "shed first" }, { "id": "s-age", "label": "Queue age over SLO", "kind": "risk", "sub": "alert, never allow" } ] }, { "title": "Scan", "nodes": [ { "id": "s-trivy", "label": "Trivy Pool", "kind": "app", "sub": "OS + language", "icon": "fa5_bug" }, { "id": "s-grype", "label": "Grype Pool", "kind": "app", "sub": "second opinion", "icon": "fa5_bug" } ] }, { "title": "Normalise", "nodes": [ { "id": "s-purl", "label": "purl and Advisory Ids", "kind": "app", "icon": "fa5_barcode" }, { "id": "s-sev", "label": "Severity Reconcile", "kind": "app", "sub": "two sources", "icon": "fa5_balance_scale" } ] }, { "title": "Attest", "nodes": [ { "id": "s-sign", "label": "Sign Result", "kind": "security", "sub": "cosign · OpenVEX", "icon": "fa5_signature" }, { "id": "s-ref", "label": "Push Referrer", "kind": "integration", "sub": "subject digest", "icon": "fa5_sitemap" } ] }, { "title": "Index", "nodes": [ { "id": "s-fnd", "label": "Findings Store", "kind": "store", "icon": "clickhouse" }, { "id": "s-idx", "label": "Component Index", "kind": "store", "icon": "clickhouse" } ] } ], "edges": [ { "from": "s-new", "to": "s-fnd", "label": "cached layer verdict reused", "kind": "batch", "route": "gutter" } ], "note": "An unchanged base layer is scanned once, not once per derived image. Push to verdict p95 ≤ 10 min.", "meta": { "v": "1.0", "owner": "Platform Engineering", "date": "2026-09" } }, { "id": "17-admission-decision-sequence", "title": "Admission Decision — Critical Flow", "layout": "sequence", "lifelines": [ { "id": "a-api", "label": "kube-apiserver", "kind": "external", "icon": "kubernetes" }, { "id": "a-adm", "label": "Admission Controller", "kind": "security", "icon": "fa5_shield_alt" }, { "id": "a-bun", "label": "Local Bundle Cache", "kind": "store", "icon": "pattern_cache" }, { "id": "a-evc", "label": "Local Evidence Cache", "kind": "store", "icon": "pattern_cache" }, { "id": "a-eva", "label": "Regional Evidence API", "kind": "integration", "icon": "fa5_file_contract" }, { "id": "a-aud", "label": "Audit Ledger", "kind": "security", "icon": "fa5_archive" } ], "messages": [ { "from": "a-api", "to": "a-adm", "label": "AdmissionReview · Pod", "kind": "call" }, { "from": "a-adm", "to": "a-adm", "label": "extract image references", "kind": "self" }, { "from": "a-adm", "to": "a-bun", "label": "bundle for env=prod", "kind": "call" }, { "from": "a-bun", "to": "a-adm", "label": "v247 · age 42 s", "kind": "return" }, { "from": "a-adm", "to": "a-evc", "label": "inputs for sha256:9f3c…", "kind": "call" }, { "from": "a-evc", "to": "a-adm", "label": "hit · 3 s old", "kind": "return" }, { "from": "a-adm", "to": "a-eva", "label": "miss → fetch, 2 s cap", "kind": "call" }, { "from": "a-eva", "to": "a-adm", "label": "attestations + findings", "kind": "return" }, { "from": "a-adm", "to": "a-adm", "label": "verify signatures offline", "kind": "self" }, { "from": "a-adm", "to": "a-adm", "label": "evaluate rego · 12 rules", "kind": "self" }, { "from": "a-adm", "to": "a-api", "label": "ALLOW / DENY + reasons", "kind": "return" }, { "from": "a-adm", "to": "a-aud", "label": "decision + evidence digests", "kind": "async" }, { "from": "a-adm", "to": "a-api", "label": "timeout → env posture", "kind": "error" } ], "note": "p50 ≤ 25 ms, p99 ≤ 150 ms. The common case never leaves the cluster.", "meta": { "v": "1.0", "owner": "Security Architecture", "date": "2026-09" } }, { "id": "18-advisory-reconciliation", "title": "Advisory Ingest and Two-Feed Reconciliation", "layout": "swimlane", "stages": [ "Fetch", "Normalise", "Reconcile", "Decide", "Publish" ], "laneHeaderWidth": 150, "lanes": [ { "title": "Feed A · OSV", "cells": [ [ { "id": "v-a1", "label": "OSV Mirror", "kind": "external", "sub": "15 min poll", "icon": "external_feed" } ], [ { "id": "v-a2", "label": "purl + version range", "kind": "app", "icon": "fa5_barcode" } ], [ { "id": "v-a3", "label": "Advisory record A", "kind": "store", "icon": "clickhouse" } ], [], [] ] }, { "title": "Feed B · distro + NVD", "cells": [ [ { "id": "v-b1", "label": "Distro and NVD Mirror", "kind": "external", "sub": "hourly", "icon": "external_feed" } ], [ { "id": "v-b2", "label": "CPE → purl map", "kind": "app", "icon": "fa5_balance_scale" } ], [ { "id": "v-b3", "label": "Advisory record B", "kind": "store", "icon": "clickhouse" } ], [], [] ] }, { "title": "Reconciler", "cells": [ [], [], [ { "id": "v-c3", "label": "Merge by identifier", "kind": "app", "sub": "CVE · GHSA", "icon": "fa5_balance_scale" } ], [ { "id": "v-c4", "label": "Feeds agree?", "kind": "decision" } ], [ { "id": "v-c5", "label": "Advisory Store", "kind": "store", "sub": "one record per id", "icon": "clickhouse" } ] ] }, { "title": "Disagreement", "cells": [ [], [], [], [ { "id": "v-d4", "label": "Severity conflict", "kind": "risk", "sub": "not acted on" } ], [ { "id": "v-d5", "label": "Flagged for review", "kind": "security", "icon": "fa5_bell" } ] ] }, { "title": "Staleness", "cells": [ [ { "id": "v-e1", "label": "Feed age metric", "kind": "platform", "icon": "fa5_stopwatch" } ], [], [], [ { "id": "v-e4", "label": "Age over 6 h?", "kind": "decision" } ], [ { "id": "v-e5", "label": "Policy input + alert", "kind": "security", "icon": "fa5_bell" } ] ] } ], "note": "One failing feed does not stall evaluation. A severity in one feed and absent from the other is flagged, never applied.", "meta": { "v": "1.0", "owner": "Security Architecture", "date": "2026-09" } }, { "id": "19-advisory-re-evaluation", "title": "Re-Evaluation When the Advisory Moves, Not the Image", "layout": "flow", "chain": true, "canvas": { "width": 1800 }, "nodeWidth": 190, "stages": [ { "title": "Advisory change", "nodes": [ { "id": "w-new", "label": "New or Amended", "kind": "queue", "sub": "reconciled record", "icon": "external_feed" }, { "id": "w-wdr", "label": "Withdrawn", "kind": "app", "sub": "marked, never deleted", "icon": "fa5_history" } ] }, { "title": "Match", "nodes": [ { "id": "w-idx", "label": "Component Index Lookup", "kind": "store", "sub": "purl + range", "icon": "clickhouse" }, { "id": "w-aff", "label": "Affected Digests", "kind": "app", "sub": "~120 of 40,000", "icon": "fa5_project_diagram" } ] }, { "title": "Fan out", "nodes": [ { "id": "w-job", "label": "Re-Evaluation Jobs", "kind": "queue", "sub": "one per digest", "icon": "fa5_sync_alt" }, { "id": "w-pri", "label": "Running workloads first", "kind": "decision" } ] }, { "title": "Re-evaluate", "nodes": [ { "id": "w-fs", "label": "Finding Set Rebuild", "kind": "app", "icon": "fa5_bug" }, { "id": "w-sup", "label": "Suppression Check", "kind": "app", "sub": "expiry aware", "icon": "fa5_bell_slash" }, { "id": "w-rch", "label": "Reachability", "kind": "app", "sub": "where supported", "icon": "fa5_microscope" } ] }, { "title": "Evidence update", "nodes": [ { "id": "w-rec", "label": "New Finding Record", "kind": "store", "sub": "supersedes, appends", "icon": "fa5_file_contract" }, { "id": "w-sig", "label": "Signed Scan Result", "kind": "security", "sub": "new referrer", "icon": "fa5_signature" } ] }, { "title": "Impact", "nodes": [ { "id": "w-map", "label": "Running Workload Map", "kind": "app", "sub": "cluster + workload", "icon": "fa5_project_diagram" }, { "id": "w-evt", "label": "Verdict Change Event", "kind": "queue" } ] }, { "title": "Act", "nodes": [ { "id": "w-own", "label": "Owner Notification", "kind": "security", "icon": "fa5_bell" }, { "id": "w-alr", "label": "Alert Above Severity", "kind": "security", "icon": "fa5_bell" }, { "id": "w-evi", "label": "Eviction or Drain", "kind": "risk", "sub": "phase 3, not automatic" } ] } ], "edges": [ { "from": "w-rec", "to": "w-map", "label": "affected workloads", "kind": "async" } ], "note": "Cost scales with affected artifacts, not stored artifacts. Advisory to re-evaluated finding set p95 ≤ 60 min.", "meta": { "v": "1.0", "owner": "Security Architecture", "date": "2026-09" } }, { "id": "20-offline-verification-sequence", "title": "Air-Gapped Verification — Deciding Without the Platform", "layout": "sequence", "lifelines": [ { "id": "o-api", "label": "Edge kube-apiserver", "kind": "external", "icon": "kubernetes" }, { "id": "o-adm", "label": "Edge Admission Controller", "kind": "security", "icon": "fa5_shield_alt" }, { "id": "o-reg", "label": "Local Registry", "kind": "integration", "icon": "fa5_warehouse" }, { "id": "o-bun", "label": "Offline Evidence Bundle", "kind": "store", "icon": "fa5_file_contract" }, { "id": "o-tru", "label": "Offline Trust Store", "kind": "store", "icon": "fa5_key" } ], "messages": [ { "from": "o-api", "to": "o-adm", "label": "AdmissionReview · Pod", "kind": "call" }, { "from": "o-adm", "to": "o-reg", "label": "resolve locally", "kind": "call" }, { "from": "o-reg", "to": "o-adm", "label": "sha256:9f3c…", "kind": "return", "icon": "fa5_fingerprint" }, { "from": "o-adm", "to": "o-bun", "label": "attestations for digest", "kind": "call" }, { "from": "o-bun", "to": "o-adm", "label": "DSSE + Rekor SET", "kind": "return" }, { "from": "o-adm", "to": "o-tru", "label": "trust roots", "kind": "call" }, { "from": "o-tru", "to": "o-adm", "label": "Fulcio root + log key", "kind": "return" }, { "from": "o-adm", "to": "o-adm", "label": "verify chain offline", "kind": "self" }, { "from": "o-adm", "to": "o-adm", "label": "verify inclusion proof", "kind": "self" }, { "from": "o-adm", "to": "o-adm", "label": "check revocation list age", "kind": "self" }, { "from": "o-adm", "to": "o-api", "label": "DENY: roots over 30 d", "kind": "error" }, { "from": "o-adm", "to": "o-api", "label": "ALLOW · offline path", "kind": "return" } ], "note": "No call leaves the site. Verification needs the artifact, its evidence, the inclusion proof and the trust roots.", "meta": { "v": "1.0", "owner": "Security Architecture", "date": "2026-09" } }, { "id": "21-promotion-and-lifecycle", "title": "Promotion, Demotion and Retention", "layout": "flow", "chain": true, "canvas": { "width": 1800 }, "nodeWidth": 168, "stages": [ { "title": "Build output", "nodes": [ { "id": "x-dev", "label": "Development Repository", "kind": "integration", "sub": "untagged 30 d", "icon": "fa5_warehouse" } ] }, { "title": "Development gate", "nodes": [ { "id": "x-g1", "label": "Signature valid", "kind": "decision" }, { "id": "x-g2", "label": "SBOM present", "kind": "decision", "icon": "fa5_clipboard_list" } ] }, { "title": "Staging gate", "nodes": [ { "id": "x-g3", "label": "Scan complete", "kind": "decision" }, { "id": "x-g4", "label": "No unsuppressed critical", "kind": "decision" }, { "id": "x-g5", "label": "Builder on allowlist", "kind": "decision" } ] }, { "title": "Production gate", "nodes": [ { "id": "x-g6", "label": "All staging gates", "kind": "decision" }, { "id": "x-g7", "label": "Base image allowlisted", "kind": "decision" }, { "id": "x-g8", "label": "Finding age within limit", "kind": "decision" } ] }, { "title": "Record", "nodes": [ { "id": "x-att", "label": "Promotion Attestation", "kind": "security", "sub": "signed · names both", "icon": "fa5_stamp" }, { "id": "x-bun", "label": "Bundle Version Recorded", "kind": "store", "icon": "postgresql" } ] }, { "title": "Production", "nodes": [ { "id": "x-prod", "label": "Production Repository", "kind": "integration", "sub": "2 y after last deploy", "icon": "fa5_warehouse" }, { "id": "x-imm", "label": "Immutable Tags", "kind": "store", "icon": "fa5_tag" } ] }, { "title": "Reverse", "nodes": [ { "id": "x-quar", "label": "Quarantine", "kind": "risk", "sub": "next admission denies" }, { "id": "x-dem", "label": "Demotion", "kind": "app", "sub": "signed, like promotion" } ] } ], "edges": [ { "from": "x-quar", "to": "x-prod", "label": "marks ineligible", "kind": "error", "route": "gutter" } ], "note": "Promotion is an assertion about an existing digest. Nothing is rebuilt and nothing is re-tagged.", "meta": { "v": "1.0", "owner": "Platform Engineering", "date": "2026-09" } }, { "id": "22-exception-lifecycle", "title": "Exceptions and Suppressions — Policy, Never Bypass", "layout": "cycle", "centre": { "label": "Exceptions", "sub": "all expire", "icon": "fa5_ticket_alt" }, "nodes": [ { "id": "z-raise", "label": "Raise", "kind": "actor", "sub": "scoped request", "icon": "fa5_ticket_alt" }, { "id": "z-just", "label": "Justify", "kind": "app", "sub": "reason + digest", "icon": "fa5_file_alt" }, { "id": "z-appr", "label": "Approve", "kind": "decision", "sub": "approver ≠ requester" }, { "id": "z-enc", "label": "Encode as Data", "kind": "app", "sub": "into the bundle", "icon": "opa" }, { "id": "z-eval", "label": "Evaluate", "kind": "security", "sub": "same OPA engine", "icon": "opa" }, { "id": "z-exp", "label": "Expire", "kind": "decision", "sub": "mandatory date" }, { "id": "z-re", "label": "Re-Raise Finding", "kind": "app", "sub": "automatic", "icon": "fa5_bell" } ], "ringLabels": [ "scoped request", "evidence attached", "two-person rule", "bundle data", "decision logged", "clock runs out", "back to the queue" ], "note": "A suppression without an expiry is refused at write time. Exception ratio above threshold is an alert.", "meta": { "v": "1.0", "owner": "Security Architecture", "date": "2026-09" } }, { "id": "23-deployment-architecture", "title": "Deployment and Infrastructure — On-Premises", "layout": "nested", "boxes": [ { "title": "DC-1 — platform control plane (Kubernetes, 3 control + 12 worker)", "kind": "onprem", "dir": "row", "children": [ { "title": "Registry pool", "kind": "plain", "nodes": [ { "id": "y-hc", "label": "harbor-core", "kind": "integration", "sub": "6 pods", "icon": "fa5_warehouse" }, { "id": "y-hr", "label": "harbor-registry", "kind": "integration", "sub": "8 pods", "icon": "fa5_boxes" }, { "id": "y-hj", "label": "harbor-jobservice", "kind": "app", "sub": "4 pods", "icon": "fa5_recycle" } ] }, { "title": "Evidence pool", "kind": "plain", "nodes": [ { "id": "y-ea", "label": "attestation-api", "kind": "app", "sub": "6 pods", "icon": "fa5_file_contract" }, { "id": "y-ei", "label": "indexer", "kind": "app", "sub": "8 pods", "icon": "fa5_barcode" }, { "id": "y-ef", "label": "Fulcio", "kind": "security", "sub": "3 pods", "icon": "fa5_certificate" }, { "id": "y-er", "label": "Rekor", "kind": "security", "sub": "3 pods", "icon": "fa5_scroll" } ] }, { "title": "Stateful pool", "kind": "plain", "nodes": [ { "id": "y-pg", "label": "PostgreSQL", "kind": "store", "sub": "Patroni · 3", "icon": "postgresql" }, { "id": "y-ch", "label": "ClickHouse", "kind": "store", "sub": "6 shards × 2", "icon": "clickhouse" }, { "id": "y-kf", "label": "Kafka", "kind": "queue", "sub": "Strimzi · 5", "icon": "kafka" } ] } ] }, { "title": "DC-1 — storage and backup tier", "kind": "onprem", "dir": "row", "children": [ { "title": "Object storage", "kind": "plain", "nodes": [ { "id": "y-mn", "label": "MinIO", "kind": "store", "sub": "12 nodes · EC 8+4", "icon": "minio" }, { "id": "y-nv", "label": "NVMe Write Cache", "kind": "store", "icon": "pattern_cache" } ] }, { "title": "Backup", "kind": "plain", "nodes": [ { "id": "y-bk", "label": "Offline Backup", "kind": "store", "sub": "object lock", "icon": "fa5_archive" }, { "id": "y-dr", "label": "Restore Drill", "kind": "app", "sub": "quarterly", "icon": "fa5_history" } ] } ] }, { "title": "Workload clusters — the enforcement plane is an add-on, not a service call", "kind": "boundary", "dir": "row", "children": [ { "title": "Production", "kind": "plain", "nodes": [ { "id": "y-ap", "label": "admission-webhook", "kind": "security", "sub": "3 pods · fail-closed", "icon": "fa5_shield_alt" }, { "id": "y-sp", "label": "evidence-sync", "kind": "integration", "sub": "2 pods", "icon": "fa5_sync_alt" } ] }, { "title": "Staging", "kind": "plain", "nodes": [ { "id": "y-as", "label": "admission-webhook", "kind": "security", "sub": "2 pods · fail-closed", "icon": "fa5_shield_alt" } ] }, { "title": "Development", "kind": "plain", "nodes": [ { "id": "y-ad", "label": "admission-webhook", "kind": "security", "sub": "2 pods", "icon": "fa5_shield_alt" }, { "id": "y-fo", "label": "Fail-open posture", "kind": "risk", "sub": "stated choice" } ] } ] }, { "title": "DC-2 — read region", "kind": "onprem", "dir": "row", "children": [ { "title": "Cache and replicas", "kind": "plain", "nodes": [ { "id": "y-pc", "label": "Proxy Cache", "kind": "integration", "sub": "4 pods", "icon": "pattern_cache" }, { "id": "y-mr", "label": "MinIO Replica", "kind": "store", "icon": "minio" }, { "id": "y-erp", "label": "Evidence Replica", "kind": "store", "icon": "fa5_file_contract" } ] } ] } ], "outside": [ { "id": "y-hsm", "label": "HSM Appliance", "kind": "security", "sub": "PKCS#11 · not exportable", "icon": "fa5_lock" }, { "id": "y-lb", "label": "HAProxy + MetalLB", "kind": "integration", "icon": "haproxy" }, { "id": "y-obs", "label": "Prometheus + Grafana", "kind": "platform", "icon": "prometheus" } ], "edges": [ { "from": "y-hr", "to": "y-mn", "label": "S3 API" }, { "from": "y-ef", "to": "y-hsm", "label": "CA key operation" }, { "from": "y-sp", "to": "y-kf", "label": "evidence topic", "kind": "async" }, { "from": "y-mn", "to": "y-mr", "label": "async replication", "kind": "batch" }, { "from": "y-mn", "to": "y-bk", "label": "RPO ≤ 15 min", "kind": "batch" } ], "note": "No component is a managed cloud service. Every failure domain shown is one the platform team operates.", "meta": { "v": "1.0", "owner": "Platform Engineering", "date": "2026-09" } }, { "id": "24-cicd-and-environments", "title": "Delivery of the Platform Itself", "layout": "flow", "chain": true, "canvas": { "width": 1760 }, "nodeWidth": 200, "stages": [ { "title": "Source", "nodes": [ { "id": "b-mono", "label": "Platform Monorepo", "kind": "external", "sub": "GitLab", "icon": "gitlab" }, { "id": "b-pol", "label": "Policy Repository", "kind": "external", "sub": "Rego + tests", "icon": "git" }, { "id": "b-helm", "label": "Helm Charts", "kind": "external", "icon": "helm" } ] }, { "title": "Build", "nodes": [ { "id": "b-tkn", "label": "Tekton", "kind": "app", "sub": "self-hosted", "icon": "fa5_hammer" }, { "id": "b-test", "label": "Unit and Integration", "kind": "app", "icon": "fa5_flask" } ] }, { "title": "Self-attest", "nodes": [ { "id": "b-sbom", "label": "SBOM + Provenance", "kind": "security", "icon": "fa5_stamp" }, { "id": "b-sign", "label": "Cosign Signature", "kind": "security", "sub": "same path as tenants", "icon": "fa5_signature" } ] }, { "title": "Gate", "nodes": [ { "id": "b-dry", "label": "Dry-Run Policy", "kind": "decision", "sub": "last 24 h traffic" }, { "id": "b-diff", "label": "Bundle Diff Review", "kind": "decision", "sub": "2 approvers" } ] }, { "title": "Deliver", "nodes": [ { "id": "b-dev", "label": "Argo CD · development", "kind": "app", "icon": "argocd" }, { "id": "b-stg", "label": "Argo CD · staging", "kind": "app", "icon": "argocd" }, { "id": "b-prd", "label": "Argo CD · production", "kind": "app", "sub": "digest pinned", "icon": "argocd" } ] }, { "title": "Verify", "nodes": [ { "id": "b-adm", "label": "Admits its own image", "kind": "decision" }, { "id": "b-slo", "label": "SLO Watch", "kind": "platform", "sub": "48 h", "icon": "fa5_chart_line" } ] } ], "edges": [ { "from": "b-adm", "to": "b-prd", "label": "rollback on deny", "kind": "error", "route": "gutter" } ], "note": "The platform is its own first customer: its images pass the same admission control as everything else.", "meta": { "v": "1.0", "owner": "Platform Engineering", "date": "2026-09" } }, { "id": "25-pull-path-and-storms", "title": "Pull Path — Absorbing a Regional Scale-Out", "layout": "nested", "boxes": [ { "title": "Node local — first line, survives a registry outage", "kind": "boundary", "dir": "row", "children": [ { "title": "Per node", "kind": "plain", "nodes": [ { "id": "u-cri", "label": "containerd Image Cache", "kind": "store", "sub": "already-pulled digests", "icon": "pattern_cache" }, { "id": "u-pin", "label": "Digest-Pinned Pod Spec", "kind": "app", "sub": "no tag resolution", "icon": "k8s_pod" } ] } ] }, { "title": "Cluster local", "kind": "boundary", "dir": "row", "children": [ { "title": "Per cluster", "kind": "plain", "nodes": [ { "id": "u-mir", "label": "Registry Mirror Config", "kind": "integration", "sub": "hosts.toml", "icon": "pattern_cache" }, { "id": "u-pre", "label": "Pre-Pull DaemonSet", "kind": "app", "sub": "warms before scale-out", "icon": "k8s_daemonset" } ] } ] }, { "title": "Regional — the storm absorber", "kind": "boundary", "dir": "row", "children": [ { "title": "Per region", "kind": "plain", "nodes": [ { "id": "u-pc", "label": "Harbor Proxy Cache", "kind": "integration", "sub": "250k pulls/h burst", "icon": "pattern_cache" }, { "id": "u-nv", "label": "NVMe Cache Tier", "kind": "store", "icon": "pattern_cache" }, { "id": "u-hit", "label": "Hit Ratio ≥ 97%", "kind": "platform", "sub": "measured, alerted", "icon": "fa5_chart_line" } ] } ] }, { "title": "Origin — write region", "kind": "boundary", "dir": "row", "children": [ { "title": "Origin", "kind": "plain", "nodes": [ { "id": "u-org", "label": "Harbor Origin", "kind": "integration", "sub": "pull ≥ 99.95%", "icon": "fa5_warehouse" }, { "id": "u-min", "label": "MinIO Primary", "kind": "store", "icon": "minio" } ] } ] } ], "outside": [ { "id": "u-cold", "label": "Cold Digest on Scale-Out", "kind": "risk", "sub": "expected to fail" }, { "id": "u-cost", "label": "Cross-Region Egress", "kind": "app", "sub": "named cost line", "icon": "fa5_money_check_alt" } ], "edges": [ { "from": "u-cri", "to": "u-mir", "label": "miss" }, { "from": "u-mir", "to": "u-pc", "label": "miss" }, { "from": "u-pc", "to": "u-org", "label": "miss only" }, { "from": "u-cold", "to": "u-pc", "label": "no warm copy", "kind": "error" } ], "note": "The origin sees the misses, not the storm. A cached upstream image is a first-party artifact and acquires its own evidence.", "meta": { "v": "1.0", "owner": "SRE", "date": "2026-09" } }, { "id": "26-observability", "title": "Observability and Operations", "layout": "grid", "columns": [ "Emit", "Collect", "Store", "Consume", "Act" ], "laneHeaderWidth": 150, "rows": [ { "title": "Admission", "cells": [ [ { "id": "o-a1", "label": "Verdict + reason", "kind": "app" } ], [ { "id": "o-a2", "label": "OTel Collector", "kind": "integration", "icon": "opentelemetry" } ], [ { "id": "o-a3", "label": "Prometheus", "kind": "store", "icon": "prometheus" } ], [ { "id": "o-a4", "label": "Deny reason board", "kind": "platform", "icon": "fa5_chart_line" } ], [ { "id": "o-a5", "label": "Page on deny spike", "kind": "security", "icon": "fa5_bell" } ] ] }, { "title": "Registry", "cells": [ [ { "id": "o-r1", "label": "Pull and push latency", "kind": "app" } ], [ { "id": "o-r2", "label": "OTel Collector", "kind": "integration", "icon": "opentelemetry" } ], [ { "id": "o-r3", "label": "Prometheus", "kind": "store", "icon": "prometheus" } ], [ { "id": "o-r4", "label": "Pull path SLO", "kind": "platform", "icon": "fa5_chart_line" } ], [ { "id": "o-r5", "label": "Page on error budget", "kind": "security", "icon": "fa5_bell" } ] ] }, { "title": "Evidence", "cells": [ [ { "id": "o-e1", "label": "Attest and replicate lag", "kind": "app" } ], [ { "id": "o-e2", "label": "OTel Collector", "kind": "integration", "icon": "opentelemetry" } ], [ { "id": "o-e3", "label": "Prometheus", "kind": "store", "icon": "prometheus" } ], [ { "id": "o-e4", "label": "Freshness board", "kind": "platform", "icon": "fa5_chart_line" } ], [ { "id": "o-e5", "label": "Alert on lag", "kind": "security", "icon": "fa5_bell" } ] ] }, { "title": "Scanning", "cells": [ [ { "id": "o-s1", "label": "Queue depth and age", "kind": "app" } ], [ { "id": "o-s2", "label": "OTel Collector", "kind": "integration", "icon": "opentelemetry" } ], [ { "id": "o-s3", "label": "Prometheus", "kind": "store", "icon": "prometheus" } ], [ { "id": "o-s4", "label": "Backlog board", "kind": "platform", "icon": "fa5_chart_line" } ], [ { "id": "o-s5", "label": "Alert, never allow", "kind": "security", "icon": "fa5_bell" } ] ] }, { "title": "Advisory feeds", "cells": [ [ { "id": "o-f1", "label": "Ingestion lag", "kind": "app" } ], [ { "id": "o-f2", "label": "OTel Collector", "kind": "integration", "icon": "opentelemetry" } ], [ { "id": "o-f3", "label": "Prometheus", "kind": "store", "icon": "prometheus" } ], [ { "id": "o-f4", "label": "Feed health", "kind": "platform", "icon": "fa5_chart_line" } ], [ { "id": "o-f5", "label": "Policy denies on age", "kind": "security", "icon": "fa5_bell" } ] ] }, { "title": "Signing and keys", "cells": [ [ { "id": "o-k1", "label": "Cert issue + key use", "kind": "app" } ], [ { "id": "o-k2", "label": "Fluent Bit", "kind": "integration", "icon": "fluentd" } ], [ { "id": "o-k3", "label": "Loki + immudb", "kind": "store", "icon": "loki" } ], [ { "id": "o-k4", "label": "Key usage review", "kind": "platform", "icon": "fa5_chart_line" } ], [ { "id": "o-k5", "label": "Alert on break-glass", "kind": "security", "icon": "fa5_bell" } ] ] }, { "title": "Posture and cost", "cells": [ [ { "id": "o-p1", "label": "Violations, bytes, scans", "kind": "app" } ], [ { "id": "o-p2", "label": "Exporter", "kind": "integration", "icon": "prometheus" } ], [ { "id": "o-p3", "label": "ClickHouse", "kind": "store", "icon": "clickhouse" } ], [ { "id": "o-p4", "label": "Team cost report", "kind": "platform", "icon": "fa5_money_check_alt" } ], [ { "id": "o-p5", "label": "Alert over share", "kind": "security", "icon": "fa5_bell" } ] ] } ], "note": "Count of running workloads in violation of current policy is a first-class metric, not a report.", "meta": { "v": "1.0", "owner": "SRE", "date": "2026-09" } }, { "id": "27-operations-loop", "title": "The Operator Loop", "layout": "cycle", "centre": { "label": "Posture", "sub": "violations vs budget" }, "nodes": [ { "id": "k-mea", "label": "Measure", "kind": "platform", "sub": "workloads in violation", "icon": "fa5_chart_line" }, { "id": "k-tri", "label": "Triage", "kind": "app", "sub": "blocked or running?", "icon": "fa5_search" }, { "id": "k-rem", "label": "Remediate", "kind": "app", "sub": "rebuild on patched base", "icon": "fa5_tools" }, { "id": "k-ratt", "label": "Re-Attest", "kind": "security", "sub": "new evidence, new digest", "icon": "fa5_stamp" }, { "id": "k-pol", "label": "Adjust Policy", "kind": "decision", "sub": "dry-run first" }, { "id": "k-rep", "label": "Report", "kind": "platform", "sub": "exceptions and cost", "icon": "fa5_chart_line" } ], "ringLabels": [ "breach signal", "ranked work", "patched base image", "admissible again", "rule change", "monthly review" ], "note": "Base-image owners are notified when a newer patched base exists; the fan-out is a single fact, not one ticket per image.", "meta": { "v": "1.0", "owner": "SRE", "date": "2026-09" } }, { "id": "28-security-trust-zones", "title": "Security Architecture — Trust Zones", "layout": "zones", "zones": [ { "title": "Untrusted — developer endpoints and upstream registries", "kind": "trust", "nodes": [ { "id": "z-dev", "label": "Developer Workstation", "kind": "actor", "icon": "role_developer" }, { "id": "z-ups", "label": "Upstream Registry", "kind": "external", "sub": "approved list only", "icon": "fa5_warehouse" }, { "id": "z-cmp", "label": "Compromised Builder", "kind": "risk", "sub": "valid signature" } ] }, { "title": "Build zone — ephemeral, no standing credentials", "kind": "trust", "nodes": [ { "id": "z-run", "label": "Tekton Runner", "kind": "app", "sub": "no long-lived secret", "icon": "fa5_hammer" }, { "id": "z-sa", "label": "SPIRE Agent", "kind": "security", "sub": "node attestation", "icon": "fa5_fingerprint" } ] }, { "title": "Platform zone — restricted, mTLS only", "kind": "trust", "nodes": [ { "id": "z-hbr", "label": "Harbor", "kind": "integration", "sub": "robot tokens ≤ 60 min", "icon": "fa5_warehouse" }, { "id": "z-ev", "label": "Evidence API", "kind": "integration", "sub": "read scoped by tenant", "icon": "fa5_file_contract" }, { "id": "z-pol", "label": "Policy Bundle Server", "kind": "integration", "icon": "opa" } ] }, { "title": "Key zone — isolated, no inbound from the build zone", "kind": "trust", "nodes": [ { "id": "z-ful", "label": "Fulcio", "kind": "security", "sub": "private CA", "icon": "fa5_certificate" }, { "id": "z-rek", "label": "Rekor", "kind": "security", "icon": "fa5_scroll" }, { "id": "z-vlt", "label": "Vault", "kind": "security", "sub": "per-operation audit", "icon": "vault" }, { "id": "z-hsm", "label": "HSM", "kind": "security", "sub": "not exportable", "icon": "fa5_lock" } ] }, { "title": "Workload zone — one enforcement point per cluster", "kind": "trust", "nodes": [ { "id": "z-adm", "label": "Admission Controller", "kind": "security", "icon": "fa5_shield_alt" }, { "id": "z-kbl", "label": "kubelet", "kind": "external", "sub": "pull-only identity", "icon": "k8s_node" } ] } ], "edges": [ { "from": "z-dev", "to": "z-run", "label": "merge request only" }, { "from": "z-ups", "to": "z-hbr", "label": "proxy cache pull" }, { "from": "z-cmp", "to": "z-hbr", "label": "revoked identity", "kind": "error" }, { "from": "z-run", "to": "z-hbr", "label": "push · repo scoped" }, { "from": "z-run", "to": "z-ful", "label": "SVID → cert · mTLS" }, { "from": "z-ful", "to": "z-vlt", "label": "CA key operation" }, { "from": "z-vlt", "to": "z-hsm", "label": "PKCS#11" }, { "from": "z-adm", "to": "z-ev", "label": "mTLS · read only" }, { "from": "z-kbl", "to": "z-hbr", "label": "pull only" } ], "note": "A valid signature from a revoked builder is an expected event, handled by revocation rather than deletion.", "meta": { "v": "1.0", "owner": "Security Architecture", "date": "2026-09" } }, { "id": "29-identity-and-credentials", "title": "Workload Identity and Credential Issue", "layout": "sequence", "lifelines": [ { "id": "i-pod", "label": "Build Pod", "kind": "app", "icon": "fa5_hammer" }, { "id": "i-agt", "label": "SPIRE Agent", "kind": "security", "icon": "fa5_fingerprint" }, { "id": "i-srv", "label": "SPIRE Server", "kind": "security", "icon": "fa5_fingerprint" }, { "id": "i-kc", "label": "Keycloak", "kind": "security", "icon": "keycloak" }, { "id": "i-hbr", "label": "Harbor", "kind": "integration", "icon": "fa5_warehouse" }, { "id": "i-ful", "label": "Fulcio", "kind": "security", "icon": "fa5_certificate" } ], "messages": [ { "from": "i-pod", "to": "i-agt", "label": "workload API", "kind": "call" }, { "from": "i-agt", "to": "i-srv", "label": "node attestation", "kind": "call" }, { "from": "i-srv", "to": "i-agt", "label": "entry match", "kind": "return" }, { "from": "i-agt", "to": "i-pod", "label": "SVID · 5 min", "kind": "return" }, { "from": "i-pod", "to": "i-hbr", "label": "token exchange", "kind": "call" }, { "from": "i-hbr", "to": "i-kc", "label": "validate issuer + claims", "kind": "call" }, { "from": "i-kc", "to": "i-hbr", "label": "claims accepted", "kind": "return" }, { "from": "i-hbr", "to": "i-pod", "label": "robot token · 60 min", "kind": "return" }, { "from": "i-pod", "to": "i-ful", "label": "SVID → signing cert", "kind": "call" }, { "from": "i-ful", "to": "i-pod", "label": "SAN = SPIFFE ID", "kind": "return" }, { "from": "i-pod", "to": "i-hbr", "label": "push apps/checkout", "kind": "call" }, { "from": "i-hbr", "to": "i-pod", "label": "403 outside scope", "kind": "error" } ], "note": "No push credential exceeds 60 minutes, and no runtime identity is ever issued one. Shared credentials do not exist.", "meta": { "v": "1.0", "owner": "Security Architecture", "date": "2026-09" } }, { "id": "30-keys-and-trust-roots", "title": "Key Management and Trust Roots", "layout": "nested", "boxes": [ { "title": "Offline root — ceremony, air-gapped, two-person", "kind": "trust", "dir": "row", "children": [ { "title": "TUF root", "kind": "plain", "nodes": [ { "id": "j-root", "label": "root.json", "kind": "security", "sub": "5-of-9 threshold", "icon": "fa5_key" }, { "id": "j-share", "label": "Root Key Shares", "kind": "security", "sub": "HSM smartcards", "icon": "fa5_key" }, { "id": "j-old", "label": "Superseded Roots", "kind": "store", "sub": "verifiable 7 y", "icon": "fa5_key" } ] } ] }, { "title": "Online signing — the keyless path", "kind": "trust", "dir": "row", "children": [ { "title": "CA and logs", "kind": "plain", "nodes": [ { "id": "j-int", "label": "Fulcio Intermediate", "kind": "security", "sub": "Vault PKI · 90 d", "icon": "fa5_certificate" }, { "id": "j-rek", "label": "Rekor Signing Key", "kind": "security", "icon": "fa5_key" }, { "id": "j-ct", "label": "CT Log Key", "kind": "security", "icon": "fa5_key" } ] } ] }, { "title": "Long-lived — air-gap and release path", "kind": "trust", "dir": "row", "children": [ { "title": "HSM held", "kind": "plain", "nodes": [ { "id": "j-air", "label": "Air-Gap Release Key", "kind": "security", "sub": "never exported", "icon": "fa5_key" }, { "id": "j-bun", "label": "Policy Bundle Key", "kind": "security", "icon": "fa5_key" }, { "id": "j-base", "label": "Base Image Key", "kind": "security", "icon": "fa5_key" } ] } ] }, { "title": "Distribution and rotation", "kind": "boundary", "dir": "row", "children": [ { "title": "To every verifier", "kind": "plain", "nodes": [ { "id": "j-meta", "label": "TUF Metadata", "kind": "store", "sub": "timestamp 1 d", "icon": "fa5_key" }, { "id": "j-tb", "label": "In-Cluster Trust Bundle", "kind": "store", "sub": "≤ 30 d offline", "icon": "fa5_key" }, { "id": "j-rot", "label": "Rotation Runbook", "kind": "app", "sub": "no re-signing needed", "icon": "fa5_sync_alt" } ] } ] } ], "outside": [ { "id": "j-hsm", "label": "HSM Appliance", "kind": "security", "sub": "PKCS#11 · logged per op", "icon": "fa5_lock" }, { "id": "j-quo", "label": "Root Ceremony Quorum", "kind": "actor", "sub": "grant ≠ use", "icon": "person_approver" } ], "edges": [ { "from": "j-root", "to": "j-int", "label": "delegates" }, { "from": "j-root", "to": "j-meta", "label": "signs targets" }, { "from": "j-meta", "to": "j-tb", "label": "polled", "kind": "async" }, { "from": "j-int", "to": "j-hsm", "label": "PKCS#11" }, { "from": "j-air", "to": "j-hsm", "label": "resident" }, { "from": "j-old", "to": "j-tb", "label": "still verifiable" } ], "note": "Rotation never invalidates signatures made under the previous root. No single identity may both grant signing authority and use it.", "meta": { "v": "1.0", "owner": "Security Architecture", "date": "2026-09" } }, { "id": "31-revocation-propagation", "title": "Revocation — Invalidate Without Deleting", "layout": "flow", "chain": true, "canvas": { "width": 1800 }, "nodeWidth": 175, "stages": [ { "title": "Detect", "nodes": [ { "id": "v-rep", "label": "Compromise Report", "kind": "actor", "icon": "person_approver" }, { "id": "v-mon", "label": "Log Monitor", "kind": "app", "sub": "Rekor anomaly", "icon": "fa5_scroll" } ] }, { "title": "Revoke", "nodes": [ { "id": "v-spr", "label": "SPIRE Entry Removed", "kind": "security", "icon": "fa5_fingerprint" }, { "id": "v-ful", "label": "Fulcio Identity Banned", "kind": "security", "icon": "fa5_certificate" }, { "id": "v-rob", "label": "Robot Account Disabled", "kind": "security", "icon": "fa5_robot" } ] }, { "title": "Publish", "nodes": [ { "id": "v-crl", "label": "Revocation List", "kind": "store", "sub": "signed · versioned", "icon": "fa5_ban" }, { "id": "v-reb", "label": "Bundle Rebuild", "kind": "app", "sub": "signer allowlist", "icon": "opa" } ] }, { "title": "Distribute", "nodes": [ { "id": "v-top", "label": "Control Topic", "kind": "queue", "sub": "push", "icon": "kafka" }, { "id": "v-pol", "label": "Bundle Poll", "kind": "integration", "sub": "≤ 5 min", "icon": "fa5_broadcast_tower" } ] }, { "title": "Refresh", "nodes": [ { "id": "v-enf", "label": "Enforcement Points", "kind": "security", "sub": "p95 ≤ 5 min", "icon": "fa5_shield_alt" }, { "id": "v-inv", "label": "Cache Invalidated", "kind": "app", "sub": "p100 ≤ 15 min", "icon": "fa5_ban" } ] }, { "title": "Effect", "nodes": [ { "id": "v-den", "label": "Next Admission Denies", "kind": "decision", "sub": "nothing deleted" }, { "id": "v-run", "label": "Running Pods Continue", "kind": "risk", "sub": "eviction is separate" } ] }, { "title": "Account", "nodes": [ { "id": "v-lst", "label": "Affected Artifact List", "kind": "app", "sub": "by signer identity", "icon": "fa5_project_diagram" }, { "id": "v-plan", "label": "Rebuild Plan", "kind": "app", "sub": "under a new identity" } ] } ], "edges": [ { "from": "v-run", "to": "v-plan", "label": "drain when replaced", "kind": "error", "route": "gutter" } ], "note": "The blast radius of a compromised builder is bounded by revocation, not by deletion.", "meta": { "v": "1.0", "owner": "Security Architecture", "date": "2026-09" } }, { "id": "32-multi-tenant-isolation", "title": "Tenant Isolation — Four Layers and One Leak", "layout": "nested", "boxes": [ { "title": "Layer 1 — namespace and quota", "kind": "boundary", "dir": "row", "children": [ { "title": "Harbor projects", "kind": "plain", "nodes": [ { "id": "n-proj", "label": "Project per Tenant", "kind": "integration", "icon": "fa5_warehouse" }, { "id": "n-quo", "label": "Quota: count and bytes", "kind": "app", "icon": "fa5_percentage" }, { "id": "n-ret", "label": "Retention per Class", "kind": "app", "icon": "fa5_recycle" } ] } ] }, { "title": "Layer 2 — identity", "kind": "boundary", "dir": "row", "children": [ { "title": "One identity per principal", "kind": "plain", "nodes": [ { "id": "n-rob", "label": "Robot per Repository", "kind": "security", "sub": "push ≤ 60 min", "icon": "fa5_robot" }, { "id": "n-spf", "label": "SPIFFE ID per Builder", "kind": "security", "icon": "fa5_fingerprint" }, { "id": "n-pull", "label": "Pull Identity per Namespace", "kind": "security", "sub": "pull only", "icon": "fa5_user_lock" } ] } ] }, { "title": "Layer 3 — data", "kind": "boundary", "dir": "row", "children": [ { "title": "Scoped server side", "kind": "plain", "nodes": [ { "id": "n-flt", "label": "Tenant Filter in Evidence API", "kind": "app", "icon": "fa5_user_shield" }, { "id": "n-part", "label": "Index Partition per Tenant", "kind": "store", "icon": "clickhouse" }, { "id": "n-fnd", "label": "Findings Scoped to Project", "kind": "store", "icon": "clickhouse" } ] } ] }, { "title": "Layer 4 — discovery", "kind": "boundary", "dir": "row", "children": [ { "title": "Enumeration control", "kind": "plain", "nodes": [ { "id": "n-cat", "label": "Catalog API Filtered", "kind": "integration", "icon": "fa5_sitemap" }, { "id": "n-ref", "label": "Referrers Scoped", "kind": "integration", "icon": "fa5_sitemap" }, { "id": "n-enum", "label": "Digest Enumeration Blocked", "kind": "security", "sub": "disclosure risk", "icon": "cloud_blocked" } ] } ] } ], "outside": [ { "id": "n-dedup", "label": "Cross-Tenant Layer Dedup", "kind": "risk", "sub": "existence oracle" }, { "id": "n-mit", "label": "Dedup Scoped by Tenant Class", "kind": "app", "sub": "storage cost accepted" } ], "edges": [ { "from": "n-dedup", "to": "n-enum", "label": "defeats layer 4", "kind": "error" }, { "from": "n-mit", "to": "n-dedup", "label": "mitigates" } ], "note": "Content-addressed storage deduplicates across tenants by design; where that leaks existence, dedup is scoped and the extra bytes are paid.", "meta": { "v": "1.0", "owner": "Security Architecture", "date": "2026-09" } }, { "id": "33-failure-modes", "title": "Failure Modes and Degraded Operation", "layout": "grid", "columns": [ "Failure", "Detected by", "Degraded behaviour", "Residual risk" ], "laneHeaderWidth": 165, "rows": [ { "title": "Artifact read path", "cells": [ [ { "id": "p-1a", "label": "Registry pull down", "kind": "risk" } ], [ { "id": "p-1b", "label": "Pull SLO burn rate", "kind": "platform" } ], [ { "id": "p-1c", "label": "Node and regional cache serve", "kind": "app" } ], [ { "id": "p-1d", "label": "Cold digest scale-out fails", "kind": "decision" } ] ] }, { "title": "Artifact write path", "cells": [ [ { "id": "p-2a", "label": "Registry push down", "kind": "risk" } ], [ { "id": "p-2b", "label": "Push error rate", "kind": "platform" } ], [ { "id": "p-2c", "label": "Builds queue and back off", "kind": "app" } ], [ { "id": "p-2d", "label": "Release-day backlog", "kind": "decision" } ] ] }, { "title": "Decision point", "cells": [ [ { "id": "p-3a", "label": "Policy service unreachable", "kind": "risk" } ], [ { "id": "p-3b", "label": "Bundle age metric", "kind": "platform", "icon": "fa5_stopwatch" } ], [ { "id": "p-3c", "label": "Cached bundle ≤ 30 min", "kind": "app" } ], [ { "id": "p-3d", "label": "Beyond that, env posture", "kind": "decision" } ] ] }, { "title": "Transparency and keys", "cells": [ [ { "id": "p-4a", "label": "Rekor or Vault down", "kind": "risk" } ], [ { "id": "p-4b", "label": "Signing error rate", "kind": "platform" } ], [ { "id": "p-4c", "label": "Proofs queue, verify continues", "kind": "app" } ], [ { "id": "p-4d", "label": "Unproofed: non-prod only", "kind": "decision" } ] ] }, { "title": "Intelligence", "cells": [ [ { "id": "p-5a", "label": "Scanner backlog, feed stale", "kind": "risk" } ], [ { "id": "p-5b", "label": "Queue age and feed lag", "kind": "platform", "icon": "fa5_stopwatch" } ], [ { "id": "p-5c", "label": "Production scanned first", "kind": "app" } ], [ { "id": "p-5d", "label": "No scan, no production", "kind": "decision" } ] ] }, { "title": "Evidence integrity", "cells": [ [ { "id": "p-6a", "label": "Missing attestation, bit-rot", "kind": "risk" } ], [ { "id": "p-6b", "label": "Digest re-verified on read", "kind": "platform" } ], [ { "id": "p-6c", "label": "Quarantine and alert", "kind": "app" } ], [ { "id": "p-6d", "label": "Absent evidence is a denial", "kind": "decision" } ] ] }, { "title": "Time and replication", "cells": [ [ { "id": "p-7a", "label": "Clock skew, replication lag", "kind": "risk" } ], [ { "id": "p-7b", "label": "Bounded tolerance check", "kind": "platform" } ], [ { "id": "p-7c", "label": "Distinct retryable reason", "kind": "app" } ], [ { "id": "p-7d", "label": "Denied, never allowed", "kind": "decision" } ] ] }, { "title": "Policy change", "cells": [ [ { "id": "p-8a", "label": "Bundle misconfiguration", "kind": "risk" } ], [ { "id": "p-8b", "label": "Dry run over last 24 h", "kind": "platform" } ], [ { "id": "p-8c", "label": "Override needed over 2%", "kind": "app" } ], [ { "id": "p-8d", "label": "Override is still human", "kind": "decision" } ] ] } ], "note": "Every degraded behaviour is a stated policy choice. None of them is a silent allow.", "meta": { "v": "1.0", "owner": "SRE and Security", "date": "2026-09" } } ]