Evidence pack · sample data
ep-7F3A91
Source: Kubernetes · Deployment payments/fx-quotes · UPDATE · prod-east-2
Decided 2026-11-04 14:02:11.482 UTC · sealed 3 s later
What changedDigest of the submitted object
- image: registry.internal/fx-quotes:2.4.0 + image: registry.internal/fx-quotes:2.4.1-hotfix
change digest sha256:9f2c41d07be3a6…5c18e7a0
Who requested itIdentity at the control point
j.rivera@payments via SSO, group payments-deployers
source: kubectl · 10.42.7.19 · RBAC role deployer (namespace payments)
Which policies appliedFrozen at decision time
14 evaluated, 1 triggered. Images with critical, fixable CVEs (critical).
CVE-2026-1048 · CVSS 9.1 · EPSS 0.41 · fixed in 2.4.2
policy set version ps-2026.11.02 · sha256:41aa…0c9d
Who approvedBound to this exact change
A. Whitfield, Change Manager · approved in Slack #change-approvals, 14:01:52 UTC
Settlement hotfix. The affected package has no network listener; the upgrade to 2.4.2 is scheduled.
token apr-5C2E80 · Ed25519 · bound to sha256:9f2c41…e7a0 · expired 18:01:52 UTC
Waivers appliedNo permanent exceptions
wv-0193 · Read-only root filesystem · namespace payments
owner A. Lindqvist, Platform Security · expires 2026-11-30 · reason: vendor agent writes to /var/cache
Runtime after startFirst 15 minutes
No findings. 3 processes observed, all in the image baseline. Outbound connections only to ledger-db:5432.
Controls supportedMapped automatically
Linked changesSame release, other systems
ep-7F3A8E · GitHub · merge of pull request 2291 to main, 2 reviews
ep-7F3A8F · PostgreSQL · migration 0141 on ledger-db, no approval needed
Pack integrityVerify without Stonewake
pack digest sha256:c1d8a02f…7b3e44b9
previous pack sha256:07be19c4…a2d1f3c0 (ep-7F3A90)
signature Ed25519 + ML-DSA-65 · ledger head signed 14:05:00 UTC
Recompute the SHA-256 of the pack's canonical JSON with any standard tool. If it matches, the pack is exactly what was sealed.
$ stonewake verify ep-7F3A91.json
✓ digest matches · ✓ chain intact · ✓ signature valid