Agent processes — globex-hr-screening (AKS)
GET /v1/evidence/summary · identity-plane entries · registration log| Process | Identity | SPIFFE ID | Signed rows | What it does |
|---|---|---|---|---|
| resume-ranker | has an identity | spiffe://globex-azure.agents.hexr.cloud/globex-azure/bespoke/resume-ranker/main/proc-3954636 | 4 | Scores applications against a role's required skills. |
| interview-scorer | has an identity | spiffe://globex-azure.agents.hexr.cloud/globex-azure/bespoke/interview-scorer/main/proc-3954895 | 4 | Turns the ranking into an advance/hold recommendation. |
| candidate-dedupe | dark — no identity | none — nobody registered it, so nobody audited it | 0 | Drops applications it considers duplicates. Nobody registered it. |
Three processes in one workload. The third reads the same candidate data as the other two and signs nothing. It is not denied — it is absent. That absence is the finding.
Identity lifecycle — registration log, last few minutes
kubectl -n hexr-system logs deploy/hexr-auto-registrar| Time (UTC) | Event | Process | Identity / entry |
|---|---|---|---|
| 00:13:13 | registered | pid 2245942 | spiffe://globex-azure.agents.hexr.cloud/globex-azure/bespoke/interview-scorer/main/proc-2245942 (entry 2adcbbbf…) |
| 00:13:22 | deregistered | pid 2245942 | 1 entry removed |
| 00:14:20 | registered | pid 2246903 | spiffe://globex-azure.agents.hexr.cloud/globex-azure/bespoke/resume-ranker/main/proc-2246903 (entry c37072f3…) |
| 00:14:24 | deregistered | pid 2246903 | 1 entry removed |
| 00:14:25 | registered | pid 2247011 | spiffe://globex-azure.agents.hexr.cloud/globex-azure/bespoke/interview-scorer/main/proc-2247011 (entry 958e1d60…) |
| 00:14:31 | deregistered | pid 2247011 | 1 entry removed |
| 00:15:27 | registered | pid 2249111 | spiffe://globex-azure.agents.hexr.cloud/globex-azure/bespoke/resume-ranker/main/proc-2249111 (entry 4605c031…) |
| 00:15:35 | deregistered | pid 2249111 | 1 entry removed |
| 00:15:36 | registered | pid 2249218 | spiffe://globex-azure.agents.hexr.cloud/globex-azure/bespoke/interview-scorer/main/proc-2249218 (entry 9d095efc…) |
| 00:15:46 | deregistered | pid 2249218 | 1 entry removed |
Each stage of the pipeline is its own process with its own identity: registered when it starts, removed when it exits. A PID is reused by the kernel; an identity never is. Entries whose pod is gone are reaped after ten minutes.