Security · Converge

#	Time	Actor	Action	Target	Detail
521	14:02	kai.tran	APPLY_PLAN	meridian-health/prod	plan `pl-9f2e41` · approval token consumed (single-use) · run-8842
520	14:01	kai.tran	APPROVE	plan pl-9f2e41	token HMAC(plan, caller, expiry) issued · expires 15:01
519	13:47	reconcile ctrl	AUDIT_DELETION_SET	verde-foods/prod	deletion set written before delete · 2 delete + 1 skip · awaiting typed confirmation
518	13:46	reconcile ctrl	PLAN_RECONCILE	verde-foods/prod	3 orphans (1 not deletable on aws — will be reported, not counted)
517	09:14	copilot ⇒ kai.tran	PLAN_DEPLOY	tern-aviation/staging	plan `pl-4te7c2` rendered · apply refused: no approval token
516	09:12	copilot ⇒ kai.tran	COLLECT_CONFIG	tern-aviation/staging	31 resolved · 6 assumed (justified) · 2 confirm · 2 asked · 1 blocked
515	08:40	a.mora	DENY	INC-241 remediation	held for change window · re-queued 09:00
514	03:13	diagnose ctrl	BUNDLE_ATTACH	kestrel-bank/prod	bundle-inc-241.tgz · secrets masked · stayed in-boundary
513	yesterday	sofia.k	EXPORT_BUNDLE	cobalt-mining/prod	signed fleet bundle · sha256 recorded · contents manifest approved before egress
512	yesterday	release pipeline	PUBLISH	release 0.1.91	manifest signed · cosign key converge-release-2026 · SBOM attached

Write-ahead audit: destructive intents (entry #519) are journaled before execution; per-resource outcomes recorded after. Every entry carries actor, tool, argument digest, and result digest.

Identity providers

SSO

OIDC · corp IdP (Entra ID) active

SAML

available for partner federation

MFA

enforced for operator & admin roles

Sessions

short-lived tokens · 8h max · revocable

Agent surface

identity from launch environment or auth proxy — never from the wire, never anonymous

Roles

least privilege · per-tenant confinement

Role	Members	May	May not
viewer	31	read inventory, health, reports	any mutation
operator	12	run planned operations, approve within tenant	destructive ops without typed confirm
tenant-admin	5	approve plans, manage config & users	cross-tenant anything
fleet-admin	2	fleet views, upgrade waves	bypass per-environment approval

Tenant confinement is structural: an identifier from another tenant is not found — never “forbidden”, so non-existence leaks nothing.

Policy	Scope	Enforcement	Fleet status
Images must be release-signed no unsigned image admitted to any cluster	fleet	blocking	14/14 pass
Encryption at rest disks, object stores, database	fleet	blocking	14/14 pass
Backup before destructive stage upgrade/restore refuse without a fresh snapshot	fleet	blocking	14/14 pass
Ingress CIDR allow-list required production profile only	production	blocking	10/10 pass
Cert expiry > 21 days warn at 30, alert at 21	fleet	warning	13/14 — kestrel-bank at 12d
Region allow-list (EU sovereign) meridian, kestrel, fjord profiles	3 envs	blocking	3/3 pass

Policies are evaluated at preflight: a violating plan is refused before execution.

SOC 2 Type II

96%evidence current

Audit trail, change management, and backup-verification evidence exported automatically per control.

CIS Kubernetes benchmark

91%fleet average

12 findings across 3 environments · each mapped to a planned remediation.

Vulnerability scanning

0critical CVEs in fleet

2 high (accepted, tracked, expiring waivers) · images re-scanned on every release · SBOM per image, per release.

Every compliance claim links to its artifact — audit extracts, scan reports, signed manifests, restore-test journals. Export assembles the auditor pack.

Detection stream

streaming Falco-compatible rules · eBPF sensor on every node

Detections are observations, not actions. Containment (kill pod, isolate node, revoke token) is drafted as a plan — approved in Approvals, fully audited, reversible where possible.

Escalated — needs a decision

1 open

Outbound connection matching crypto-mining pool signature

Workload

labs-worker-1 · namespace labs · kestrel-bank/prod

Evidence

egress to pool.minexmr.example:3333 — denied by NAT allow-list · CPU pinned at 100% for 22m

Rule

CF-R-114 outbound-miner-pool · severity high

Context

student lab container — untrusted-by-design workload class; blast radius already fenced to the labs node pool

Review containment plan pl-c214 Copilot analysis

Detections · 14 days

Rule packs

versioned with the release · tuned rules ship as config plans

Pack	Rules	Coverage	24h hits	Status
container-runtime	38	shell in container · privilege escalation · sensitive mounts	4	enabled
network-egress	21	miner pools · tor exits · DNS tunneling patterns	2	enabled
k8s-control-plane	17	exec into pod · secret reads · RBAC changes	1	enabled
file-integrity	12	writes under /etc, /usr/bin · package-manager use in prod images	0	enabled
labs-profile	9	relaxed for untrusted lab workloads — fence, don't page	0	scoped: labs ns

Denied connections

streaming firewall + egress allow-list

Pod egress is NAT-locked to an allow-list — everything else lands here, including the crypto-pool attempt behind pl-c214. Firewall rules themselves live in Drift & Reconcile.

Open CVEs by severity

fleet · 90 days

Scan pipeline

Trivy + Grype engines · same gates everywhere

On build

every image scanned in CI — critical with fix ⇒ release blocked

On admission

cluster admission controller rejects unsigned or unscanned images

Nightly

re-scan running images against the freshest DB — new CVEs surface here, not at upgrade time

Vuln DB

synced 2026-08-05 06:10 · air-gapped sites receive it inside the signed release bundle

Waivers

require justification + approver + expiry — recorded as OpenVEX, auditable, never silent

Findings

4 high11 medium

CVE	Severity	Package	Exposure	KEV	EPSS	Status
CVE-2026-31842 openssl — buffer over-read in TLS session resumption	high 8.1	`libssl3 3.1.4` → 3.1.7	3 images · internet-facing (traefik)	KEV	0.34
CVE-2026-27455 golang.org/x/net — HTTP/2 rapid-reset variant	high 7.5	`x/net v0.24.0` → v0.27.1	platform-core, platform-search	—	0.21
CVE-2026-19023 postgres-client — crafted COPY response DoS	high 7.2	`libpq 16.2` · no fixed release yet	backup-agent only · no untrusted input path	—	0.08	watching upstream
CVE-2025-61207 busybox — awk OOB read (requires local shell)	high 7.0	`busybox 1.36.1`	debug sidecar image only · never runs in prod profile	—	0.03	waived · exp Oct 1
CVE-2026-22781 libxml2 — entity expansion memory growth	medium 5.9	`libxml2 2.12.3` → 2.12.6	platform-portal	—	0.05	batched → 0.1.92
CVE-2026-20114 glibc — getaddrinfo edge case	medium 5.3	`glibc 2.39` → 2.39-r4	all base images	—	0.02	batched → 0.1.92

Exposure is computed from the SBOM + the resource graph: which images contain the package, and whether those workloads face the internet. KEV = CISA Known-Exploited list · EPSS = exploit-probability score. Both ship with the offline DB.

Release SBOM — cf 0.1.91

signed

Generated by

Syft at build · one SBOM per image + one merged per release

Components

1,284 packages across 42 images

Formats

SPDX 2.3 (JSON) · CycloneDX 1.6 (JSON)

Signature

cosign, key converge-release-2026 · in-toto build attestation (SLSA provenance)

VEX

1 OpenVEX statement (CVE-2025-61207 · not_affected · prod profile)

Verify

cf release verify 0.1.91 --sbom — offline, inside your boundary

Query the SBOM

answer "are we affected?" in seconds

# which images contain a package — across every release you run

$ cf sbom query libssl --fleet

Answered from local SBOMs — no vendor status page.

License inventory

from the SBOM · policy: permissive only in shipped artifacts

Apache-2.0 / MIT / BSD

1,208 pkgs · 94%

MPL-2.0 / ISC

61 pkgs · 5%

LGPL (dynamic-linked)

15 pkgs · 1% · reviewed

Policy gate

pass no GPL/AGPL/SSPL in shipped images — checked at build, from the SBOM