Agent processes — denial-review-crew-a2a (EKS)
GET /v1/evidence/summary · identity-plane entries · registration log| Process | Identity | SPIFFE ID | Signed rows | What it does |
|---|---|---|---|---|
| claims_intake | has an identity | registered at start; see lifecycle below | 0 | Hands a denied claim to the review crew over agent-to-agent mTLS, presenting its own identity. Runs every three minutes. |
| claims_analyst | has an identity | spiffe://agents.hexr.cloud/pivot-demo/bespoke/claims_analyst/main/proc-1922812 | 2 | Parses the claim and extracts the denial-relevant facts. Its own process, its own identity. |
| policy_reviewer | has an identity | spiffe://agents.hexr.cloud/pivot-demo/bespoke/policy_reviewer/main/proc-1922957 | 2 | Cites the payer policy the denial rests on. |
| denial_writer | has an identity | spiffe://agents.hexr.cloud/pivot-demo/bespoke/denial_writer/main/proc-1923095 | 2 | Drafts the appeal and writes it to the tenant's own bucket with short-lived credentials. |
| denial-review-orchestrator | has an identity | registered at start; see lifecycle below | 1 | Receives the A2A call and runs the three stages, each in its own process. |
Five processes, five identities. claims_intake calls the crew over agent-to-agent mTLS presenting its own certificate; the crew's inbound proxy verifies it against the tenant root before anything runs. Each review stage is its own process and signs its own rows.
Identity lifecycle — registration log, last few minutes
kubectl -n hexr-system logs deploy/hexr-auto-registrar| Time (UTC) | Event | Process | Identity / entry |
|---|---|---|---|
| 21:53:01 | registered | pid 1921002 | spiffe://agents.hexr.cloud/pivot-demo/bespoke/pivot-demo-denial-review-crew-a2a/envoy/proc-1921002 (entry e2490722…) |
| 21:53:02 | registered | pid 1921033 | spiffe://agents.hexr.cloud/pivot-demo/hexr/hexr-a2a-sidecar/a2a-gateway/proc-1921033 (entry b1cd503e…) |
| 21:53:03 | registered | pid 1920949 | spiffe://agents.hexr.cloud/pivot-demo/bespoke/denial-review-crew-a2a/main/proc-1920949 (entry b4bed2e2…) |
| 21:56:05 | registered | pid 1922812 | spiffe://agents.hexr.cloud/pivot-demo/bespoke/claims_analyst/main/proc-1922812 (entry a1188f10…) |
| 21:56:14 | registered | pid 1922957 | spiffe://agents.hexr.cloud/pivot-demo/bespoke/policy_reviewer/main/proc-1922957 (entry 56c459e6…) |
| 21:56:26 | registered | pid 1923095 | spiffe://agents.hexr.cloud/pivot-demo/bespoke/denial_writer/main/proc-1923095 (entry 64936f87…) |
| 21:59:36 | registered | pid 1924999 | spiffe://agents.hexr.cloud/pivot-demo/bespoke/claims_analyst/main/proc-1924999 (entry 5a5437f7…) |
| 21:59:45 | registered | pid 1925113 | spiffe://agents.hexr.cloud/pivot-demo/bespoke/policy_reviewer/main/proc-1925113 (entry 953cafca…) |
| 21:59:54 | registered | pid 1925198 | spiffe://agents.hexr.cloud/pivot-demo/bespoke/denial_writer/main/proc-1925198 (entry d766d1a1…) |
Each stage of the pipeline is its own process with its own identity: registered when it starts, removed when it exits. A PID is reused by the kernel; an identity never is. Entries whose pod is gone are reaped after ten minutes.