The canary proves one narrow claim: every declared Witnora release deployment path used by the exercise passed through the configured credential and admission boundary. It does not claim control of undeclared paths.
tag -> GitHub OIDC -> Promotion Grant -> short-lived credential -> protected GitHub Environment -> Kubernetes AdmissionReview -> deployed digest observation -> signed enforcement events
The workflow is .github/workflows/production-complete-mediation-canary.yml.
It is manual because a fresh Promotion Grant requires an owner or administrator
to approve one exact mutation. The witnora-production-canary GitHub
Environment supplies the human approval boundary. The workflow then runs
without exposing the OIDC token or short-lived deployment credential.
Repository variables:
WITNORA_PROJECT_IDWITNORA_IDENTITY_PROVIDER_IDEnvironment secret:
WITNORA_BROKER_API_KEY, scoped only to deployments:exchange and
deployments:readWorkflow inputs bind the fresh Promotion Grant, artifact digest, and exact deployment URI. Never store a Promotion Grant or deployment credential as a long-lived repository secret.
The production workflow rejects a missing credential, image digest mismatch, target mismatch, and replay before or at admission, then admits one exact request. Unit and PostgreSQL acceptance suites additionally exercise revoked credentials, rollback, and owner-only break glass.
The retained report calculates observed P50/P95/max latency, rejection rate,
expected-decision rate, and declared-path mediation coverage. Reconciled
coverage is omitted unless a target-system audit denominator and matched count
are supplied. This prevents 100% coverage from being inferred from gateway
events alone.
Each Hosted enforcement event is Ed25519 attested. GitHub also produces an artifact attestation for the complete canary report.
Witnora reports evidence as independent dimensions rather than one inflated
score: capture, mediation, outcome, completeness, attestation, and review.
For example, a boundary can be enforced while an outcome remains unverified.
The public schema is schemas/witnora-evidence-trust-vector.schema.json.