Agent processes — denial-review-crew-a2a (EKS)
GET /v1/evidence/summary · identity-plane entries · registration log| Process | Identity | SPIFFE ID | Signed rows | What it does |
|---|---|---|---|---|
| claims_intake | has an identity | registered at start; see lifecycle below | 0 | Hands a denied claim to the review crew over agent-to-agent mTLS, presenting its own identity. Runs every three minutes. |
| claims_analyst | has an identity | spiffe://agents.hexr.cloud/pivot-demo/bespoke/claims_analyst/main/proc-1151535 | 0 | Parses the claim and extracts the denial-relevant facts. Its own process, its own identity. |
| policy_reviewer | has an identity | spiffe://agents.hexr.cloud/pivot-demo/bespoke/policy_reviewer/main/proc-1151652 | 1 | Cites the payer policy the denial rests on. |
| denial_writer | has an identity | spiffe://agents.hexr.cloud/pivot-demo/bespoke/denial_writer/main/proc-1151811 | 0 | Drafts the appeal and writes it to the tenant's own bucket with short-lived credentials. |
| denial-review-orchestrator | has an identity | spiffe://agents.hexr.cloud/pivot-demo/bespoke/denial-review-orchestrator/main/proc-1151535 | 7 | Receives the A2A call and runs the three stages, each in its own process. |
Five processes, five identities. claims_intake calls the crew over agent-to-agent mTLS presenting its own certificate; the crew's inbound proxy verifies it against the tenant root before anything runs. Each review stage is its own process and signs its own rows.
Identity lifecycle — registration log, last few minutes
kubectl -n hexr-system logs deploy/hexr-auto-registrar| Time (UTC) | Event | Process | Identity / entry |
|---|---|---|---|
| 00:13:09 | deregistered | pid 1149635 | 2 entry removed |
| 00:16:12 | registered | pid 1151535 | spiffe://agents.hexr.cloud/pivot-demo/bespoke/denial-review-orchestrator/main/proc-1151535 (entry 210c50bb…) |
| 00:16:16 | registered | pid 1151535 | spiffe://agents.hexr.cloud/pivot-demo/bespoke/claims_analyst/main/proc-1151535 (entry 43d8d726…) |
| 00:16:19 | deregistered | pid 1151535 | 2 entry removed |
| 00:16:22 | registered | pid 1151652 | spiffe://agents.hexr.cloud/pivot-demo/bespoke/denial-review-orchestrator/main/proc-1151652 (entry b9379a01…) |
| 00:16:29 | registered | pid 1151652 | spiffe://agents.hexr.cloud/pivot-demo/bespoke/policy_reviewer/main/proc-1151652 (entry 64e8fde8…) |
| 00:16:31 | deregistered | pid 1151652 | 2 entry removed |
| 00:16:35 | registered | pid 1151811 | spiffe://agents.hexr.cloud/pivot-demo/bespoke/denial-review-orchestrator/main/proc-1151811 (entry a6ee2214…) |
| 00:16:36 | registered | pid 1151811 | spiffe://agents.hexr.cloud/pivot-demo/bespoke/denial_writer/main/proc-1151811 (entry e044675a…) |
| 00:16:40 | deregistered | pid 1151811 | 2 entry removed |
Each stage of the pipeline is its own process with its own identity: registered when it starts, removed when it exits. A PID is reused by the kernel; an identity never is. Entries whose pod is gone are reaped after ten minutes.