Agent processes — globex-hr-screening (AKS)
GET /v1/evidence/summary · identity-plane entries · registration log| Process | Identity | SPIFFE ID | Signed rows | What it does |
|---|---|---|---|---|
| resume-ranker | has an identity | spiffe://globex-azure.agents.hexr.cloud/globex-azure/bespoke/resume-ranker/main/proc-3954636 | 3 | Scores applications against a role's required skills. |
| interview-scorer | has an identity | spiffe://globex-azure.agents.hexr.cloud/globex-azure/bespoke/interview-scorer/main/proc-3954895 | 6 | Turns the ranking into an advance/hold recommendation. |
| candidate-dedupe | dark — no identity | none — nobody registered it, so nobody audited it | 0 | Drops applications it considers duplicates. Nobody registered it. |
Three processes in one workload. The third reads the same candidate data as the other two and signs nothing. It is not denied — it is absent. That absence is the finding.
Identity lifecycle — registration log, last few minutes
kubectl -n hexr-system logs deploy/hexr-auto-registrar| Time (UTC) | Event | Process | Identity / entry |
|---|---|---|---|
| 20:07:55 | deregistered | pid 1966304 | 1 entry removed |
| 20:07:56 | registered | pid 1966414 | spiffe://globex-azure.agents.hexr.cloud/globex-azure/bespoke/interview-scorer/main/proc-1966414 (entry 67681e18…) |
| 20:08:02 | deregistered | pid 1966414 | 1 entry removed |
| 20:08:58 | registered | pid 1967344 | spiffe://globex-azure.agents.hexr.cloud/globex-azure/bespoke/resume-ranker/main/proc-1967344 (entry 6a94ff76…) |
| 20:09:00 | deregistered | pid 1967344 | 1 entry removed |
| 20:09:01 | registered | pid 1967413 | spiffe://globex-azure.agents.hexr.cloud/globex-azure/bespoke/interview-scorer/main/proc-1967413 (entry 07205f9b…) |
| 20:09:11 | deregistered | pid 1967413 | 1 entry removed |
| 20:10:09 | registered | pid 1969436 | spiffe://globex-azure.agents.hexr.cloud/globex-azure/bespoke/resume-ranker/main/proc-1969436 (entry db5fbfa4…) |
| 20:10:17 | deregistered | pid 1969436 | 1 entry removed |
| 20:10:18 | registered | pid 1969575 | spiffe://globex-azure.agents.hexr.cloud/globex-azure/bespoke/interview-scorer/main/proc-1969575 (entry 420b6008…) |
Each stage of the pipeline is its own process with its own identity: registered when it starts, removed when it exits. A PID is reused by the kernel; an identity never is. Entries whose pod is gone are reaped after ten minutes.