Agent processes — globex-hr-screening (AKS)
GET /v1/evidence/summary · identity-plane entries · registration log| Process | Identity | SPIFFE ID | Signed rows | What it does |
|---|---|---|---|---|
| resume-ranker | has an identity | spiffe://globex-azure.agents.hexr.cloud/globex-azure/bespoke/resume-ranker/main/proc-3954636 | 4 | Scores applications against a role's required skills. |
| interview-scorer | has an identity | spiffe://globex-azure.agents.hexr.cloud/globex-azure/bespoke/interview-scorer/main/proc-3954895 | 4 | Turns the ranking into an advance/hold recommendation. |
| candidate-dedupe | dark — no identity | none — nobody registered it, so nobody audited it | 0 | Drops applications it considers duplicates. Nobody registered it. |
Three processes in one workload. The third reads the same candidate data as the other two and signs nothing. It is not denied — it is absent. That absence is the finding.
Identity lifecycle — registration log, last few minutes
kubectl -n hexr-system logs deploy/hexr-auto-registrar| Time (UTC) | Event | Process | Identity / entry |
|---|---|---|---|
| 21:58:02 | deregistered | pid 3732002 | 1 entry removed |
| 21:58:03 | registered | pid 3732071 | spiffe://globex-azure.agents.hexr.cloud/globex-azure/bespoke/interview-scorer/main/proc-3732071 (entry 5080a50c…) |
| 21:58:09 | deregistered | pid 3732071 | 1 entry removed |
| 21:59:06 | registered | pid 3733039 | spiffe://globex-azure.agents.hexr.cloud/globex-azure/bespoke/resume-ranker/main/proc-3733039 (entry f435e883…) |
| 21:59:14 | deregistered | pid 3733039 | 1 entry removed |
| 21:59:15 | registered | pid 3733291 | spiffe://globex-azure.agents.hexr.cloud/globex-azure/bespoke/interview-scorer/main/proc-3733291 (entry 21fc334e…) |
| 21:59:20 | deregistered | pid 3733291 | 1 entry removed |
| 22:00:16 | registered | pid 3735129 | spiffe://globex-azure.agents.hexr.cloud/globex-azure/bespoke/resume-ranker/main/proc-3735129 (entry 48ce4f41…) |
| 22:00:24 | deregistered | pid 3735129 | 1 entry removed |
| 22:00:25 | registered | pid 3735274 | spiffe://globex-azure.agents.hexr.cloud/globex-azure/bespoke/interview-scorer/main/proc-3735274 (entry 6a04fd23…) |
Each stage of the pipeline is its own process with its own identity: registered when it starts, removed when it exits. A PID is reused by the kernel; an identity never is. Entries whose pod is gone are reaped after ten minutes.