From b97c3d7d1f293b4736cc304f750634ddff88bdd2 Mon Sep 17 00:00:00 2001 From: Lukas Wuttke Date: Mon, 3 Aug 2026 08:16:14 +0200 Subject: [PATCH 1/2] =?UTF-8?q?docs(rfc):=20fill=20the=20D12=20=C2=A78.3?= =?UTF-8?q?=20guarantee=20matrix=20(RFC-0003,=20#1184-1)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The matrix was placeholder cells + a 'to be filled precisely' note. It's now the honest, customer-quotable artifact: enforced/conditional/recommended/not- available per substrate, grounded in the chart-side seal-check table (client/docs/SEAL-CHECK.md) and the recorded k3d substrate run (#504). - k3d NetworkPolicy: conditional → substrate-verified (k3s v1.33.6+k3s1 blocks egress, 2026-07-30); full-chart probe run still pending. - cloud/bare-metal netpol: conditional on the CNI, verified per-fleet by the egress-enforcement probe; OpenShift enforced natively (OVN). - storage: enforced (Option C node-local verified by storage-assertions); encryption + confidential-compute rows filled per substrate. - §8.4 updated to record the substrate run so it matches the matrix. Docs-only. Remaining #1184 residual: the full-chart e2e probe run (#1184-2) bumps the k3d cell to fully-verified; optional membership guard (#1184-3). Co-Authored-By: Claude Fable 5 --- .../rfcs/0003-storage-and-offboard-hygiene.md | 40 ++++++++++++++----- 1 file changed, 29 insertions(+), 11 deletions(-) diff --git a/docs/rfcs/0003-storage-and-offboard-hygiene.md b/docs/rfcs/0003-storage-and-offboard-hygiene.md index 2f21dfc..d4c03de 100644 --- a/docs/rfcs/0003-storage-and-offboard-hygiene.md +++ b/docs/rfcs/0003-storage-and-offboard-hygiene.md @@ -482,20 +482,38 @@ environment that cannot enforce a guarantee is explicitly marked *unsealed* ### 8.3 The guarantee matrix (D12) Enforcement differs per substrate; the matrix is the honest artifact a -customer security review can quote. To be filled precisely as part of D12 -(cells: enforced / conditional / recommended / not available): - -| Guarantee | k3d local | EKS | AKS | OpenShift | bare metal | +customer security review can quote. Cell vocabulary: **enforced** — holds by +construction on this substrate; **conditional** — holds when the substrate is +configured for it (e.g. a NetworkPolicy-enforcing CNI); **recommended** — +operator responsibility, not platform-enforced; **not available**. The seal +check (`tracebloc client status --seal`, D12) is the live verifier — "verified" +means it confirmed the guarantee on that cluster when the check ran. The +chart-side input table and the recorded substrate runs live in +[`client/docs/SEAL-CHECK.md`](../../../client/docs/SEAL-CHECK.md). + +| Guarantee | k3d local (k3s) | EKS | AKS | OpenShift | bare metal | |---|---|---|---|---|---| -| Storage inside cluster boundary (§5) | decided (C) | native PV | native PV | native PV | native PV | -| NetworkPolicy egress enforcement | verify (k3s embedded) | conditional (CNI mode) | conditional (CNI) | native (OVN) | conditional (CNI) | -| Encryption at rest | host FDE (recommended) | encrypted EBS | encrypted disks | platform | site policy | -| Confidential compute (§6.5) | not available | phase 2 | phase 2 (pilot) | phase 2 | hardware-dependent | +| Storage inside cluster boundary (§5) | enforced (Option C node-local; verified by `storage-assertions`) | enforced (native PV) | enforced (native PV) | enforced (native PV; PV scan degraded when `clusterScope=false`) | enforced (native PV) | +| NetworkPolicy egress enforcement | conditional → **substrate-verified**: k3s's embedded controller blocks egress (k3d v5.8.3 / k3s v1.33.6+k3s1, 2026-07-30, §8.4); full-chart probe run pending | conditional (VPC CNI netpol agent / Calico / Cilium) — verified per-fleet by `egress-enforcement` | conditional (Azure NPM / Calico) — verified per-fleet | **enforced** (OVN-Kubernetes, native) — verified per-fleet | conditional (Flannel alone does **not** enforce) — verified per-fleet | +| Encryption at rest | recommended (host FDE) | enforced (encrypted EBS) | enforced (encrypted disks) | platform-dependent | recommended (site policy) | +| Confidential compute (§6.5) | not available | phase 2 (pilot) | phase 2 (pilot) | phase 2 | hardware-dependent | + +Reading a cell: only cells naming a live check (“verified by …”) are proven on +that cluster by the seal check today. The cloud and bare-metal netpol cells +read **conditional** because enforcement depends on the CNI the operator runs; +the seal check's `egress-enforcement` probe confirms it per-fleet once the +lockdown is flipped (D6 / #199). k3d's netpol *substrate* is run-verified +(§8.4); recording the full-chart probe run is the one remaining item. ### 8.4 Verify local enforcement (D12) -Do not assume k3d enforces NetworkPolicy — verify the k3s-embedded -controller blocks egress on a local install and fold that probe into the -seal check. +Do not assume k3d enforces NetworkPolicy — verify the k3s-embedded controller +blocks egress on a local install and fold that probe into the seal check. +**Substrate status (2026-07-30):** run-verified — a deny-egress NetworkPolicy on +k3d v5.8.3 / k3s v1.33.6+k3s1 took a probe pod reachable → blocked → reachable, +so k3s *does* enforce egress on k3d. The remaining item is recording the +full-chart `egress-enforcement` probe run against a deployed release; details +and the reproducible method are in +[`client/docs/SEAL-CHECK.md`](../../../client/docs/SEAL-CHECK.md) §8.4. ## 9. Messaging reconciliation From d0574b2bddcc057245c6ac5252e944a026571a21 Mon Sep 17 00:00:00 2001 From: Lukas Wuttke Date: Mon, 3 Aug 2026 12:18:19 +0200 Subject: [PATCH 2/2] =?UTF-8?q?docs(#1184):=20fix=20broken=20cross-repo=20?= =?UTF-8?q?links=20+=20=C2=A78.4=20claim=20(Saqlain)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Both `../../../client/docs/SEAL-CHECK.md` relative links escaped the cli repo root and 404'd on GitHub's rendered blob view — replace with the absolute https://github.com/tracebloc/client/blob/develop/... URL. - §8.4 pointer no longer overclaims its target: the "evidence + reproducible method" it links to is the *substrate* run (which SEAL-CHECK.md actually records); the full-chart probe run is stated separately as the remaining item, so the claim and the linked doc no longer contradict. Co-Authored-By: Claude Opus 4.8 --- docs/rfcs/0003-storage-and-offboard-hygiene.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/docs/rfcs/0003-storage-and-offboard-hygiene.md b/docs/rfcs/0003-storage-and-offboard-hygiene.md index d4c03de..8f0f4e8 100644 --- a/docs/rfcs/0003-storage-and-offboard-hygiene.md +++ b/docs/rfcs/0003-storage-and-offboard-hygiene.md @@ -489,7 +489,7 @@ operator responsibility, not platform-enforced; **not available**. The seal check (`tracebloc client status --seal`, D12) is the live verifier — "verified" means it confirmed the guarantee on that cluster when the check ran. The chart-side input table and the recorded substrate runs live in -[`client/docs/SEAL-CHECK.md`](../../../client/docs/SEAL-CHECK.md). +[`client/docs/SEAL-CHECK.md`](https://github.com/tracebloc/client/blob/develop/docs/SEAL-CHECK.md). | Guarantee | k3d local (k3s) | EKS | AKS | OpenShift | bare metal | |---|---|---|---|---|---| @@ -510,10 +510,11 @@ Do not assume k3d enforces NetworkPolicy — verify the k3s-embedded controller blocks egress on a local install and fold that probe into the seal check. **Substrate status (2026-07-30):** run-verified — a deny-egress NetworkPolicy on k3d v5.8.3 / k3s v1.33.6+k3s1 took a probe pod reachable → blocked → reachable, -so k3s *does* enforce egress on k3d. The remaining item is recording the -full-chart `egress-enforcement` probe run against a deployed release; details -and the reproducible method are in -[`client/docs/SEAL-CHECK.md`](../../../client/docs/SEAL-CHECK.md) §8.4. +so k3s *does* enforce egress on k3d. That substrate run's evidence and its +reproducible method are recorded in +[`client/docs/SEAL-CHECK.md`](https://github.com/tracebloc/client/blob/develop/docs/SEAL-CHECK.md) §8.4. +The one remaining item is recording the full-chart `egress-enforcement` probe +run against a deployed release. ## 9. Messaging reconciliation