Skip to content

ADR 0002 — Trust model, evidence sources, and acceptance rules

Status: accepted · Date: 2026-10-02

Context

The project requires claim-specific evidence acceptance with no universal numeric trust score, and that unknown / unsupported / stale / untrusted evidence never becomes allow.

Decision

  1. Evidence categories are explicit (mock, admin_inventory, host_observation, kubernetes_observation, attestation_verifier) and carried on every Observation<T> together with a source identity and times.
  2. Observation status is one of known | unknown | unsupported | error. A known false is distinct from all non-known states.
  3. Acceptance is per-context. EvaluationContext.accepted_sources lists the categories accepted for ordinary (non-attestation) claims. Offline / observe defaults include mock. Enforce configuration omits mock, so synthetic evidence is rejected at enforcement. A not-accepted source yields SOURCE_NOT_ACCEPTED → unresolved, never allow.
  4. Freshness. A known observation is stale (→ EVIDENCE_STALE) if it has no timestamp, is older than maxAgeSeconds, or is future-dated beyond maxClockSkewSeconds. maxAgeSeconds: 0 disables the freshness check.
  5. Attestation. A verified attestation claim requires an attestation_verifier source that no default provider produces; attestation: required is therefore always unresolved (ATTESTATION_REQUIRED) and listed in the decision's unsupportedRequirements. Enforce mode blocks.
  6. Administrator assertions (region, assigned tenant) are reported as such in the decision (adminAssertions); they are not hardware-attested facts.
  7. Node binding. The pure evaluator requires candidate.nodeUid == snapshot.nodeUid; a mismatch is NODE_INCARNATION_MISMATCH. The Kubernetes observer additionally binds by node UID / incarnation.

Consequences

  • There is no code path where a missing collector, stale report, or unaccepted source produces allow.
  • The same policy evaluated in offline / observe vs enforce can differ only by becoming more conservative (fewer accepted sources), never more permissive.