Agent processes — globex-hr-screening (AKS)

GET /v1/evidence/summary · identity-plane entries · registration log
ProcessIdentitySPIFFE IDSigned rowsWhat it does
resume-rankerhas an identityspiffe://globex-azure.agents.hexr.cloud/globex-azure/bespoke/resume-ranker/main/proc-39546364Scores applications against a role's required skills.
interview-scorerhas an identityspiffe://globex-azure.agents.hexr.cloud/globex-azure/bespoke/interview-scorer/main/proc-39548954Turns the ranking into an advance/hold recommendation.
candidate-dedupedark — no identitynone — nobody registered it, so nobody audited it0Drops applications it considers duplicates. Nobody registered it.
Three processes in one workload. The third reads the same candidate data as the other two and signs nothing. It is not denied — it is absent. That absence is the finding.

Identity lifecycle — registration log, last few minutes

kubectl -n hexr-system logs deploy/hexr-auto-registrar
Time (UTC)EventProcessIdentity / entry
00:13:13registeredpid 2245942spiffe://globex-azure.agents.hexr.cloud/globex-azure/bespoke/interview-scorer/main/proc-2245942 (entry 2adcbbbf…)
00:13:22deregisteredpid 22459421 entry removed
00:14:20registeredpid 2246903spiffe://globex-azure.agents.hexr.cloud/globex-azure/bespoke/resume-ranker/main/proc-2246903 (entry c37072f3…)
00:14:24deregisteredpid 22469031 entry removed
00:14:25registeredpid 2247011spiffe://globex-azure.agents.hexr.cloud/globex-azure/bespoke/interview-scorer/main/proc-2247011 (entry 958e1d60…)
00:14:31deregisteredpid 22470111 entry removed
00:15:27registeredpid 2249111spiffe://globex-azure.agents.hexr.cloud/globex-azure/bespoke/resume-ranker/main/proc-2249111 (entry 4605c031…)
00:15:35deregisteredpid 22491111 entry removed
00:15:36registeredpid 2249218spiffe://globex-azure.agents.hexr.cloud/globex-azure/bespoke/interview-scorer/main/proc-2249218 (entry 9d095efc…)
00:15:46deregisteredpid 22492181 entry removed
Each stage of the pipeline is its own process with its own identity: registered when it starts, removed when it exits. A PID is reused by the kernel; an identity never is. Entries whose pod is gone are reaped after ten minutes.