Skip to main content

Attribute Capability Verification

Goal​

Determine the evidence-backed state of attribute administration, effective resolution, and token projection without promoting a successful request or runtime component probe into product activation.

Audience​

Use this guide when operating or supporting a Keymate realm that exposes attribute APIs.

Prerequisites​

  • Read Attribute Capability Status.
  • Identify the installed immutable release or image digest.
  • Use a principal with realm-management permission for read-only runtime inspection.

Before You Start​

Keep two state vocabularies separate:

  • runtimeState comes from the KEOPS runtime capability endpoint. Its DEPLOYED value means that the required components are available in the running realm.
  • productStatus comes from the immutable product evidence record. Its DEPLOYED value requires an authorized environment owner to observe the exact artifact or image identified by that record.

runtimeState=DEPLOYED never proves productStatus=DEPLOYED, VERIFIED, or ACTIVE. A successful definition, value, or projection-inspection request proves only that the specific request completed.

Worked Example​

Assume the runtime endpoint reports runtimeState=DEPLOYED, the immutable AKS reference image passed its exact-image tests, and the product record reports productStatus=BLOCKED with deploymentObservation=NOT_OBSERVED. The correct operator result remains BLOCKED. Do not replace it with DEPLOYED, VERIFIED, or ACTIVE.

Steps​

1. Read the product evidence record​

Start with the versioned record in evidence/attribute-capabilities.json. Confirm the capability ID, productStatus, blockers, release identities, test evidence, artifact hashes, and image digest. Reject a record with a missing or incomplete required field.

Read currentDeliveryProgress first for the latest delivery checkpoint. At the 2026-10-31 cutoff it must remain BLOCKED, with finalImmutableTuple=null and deploymentObservation=NOT_OBSERVED. Corrective Security v2026.10.29001 and the Product #667 Java SDK slice v2026.10.29 are released. KEOPS #826 / MR !1259 is terminal through successful post-merge pipeline 3007438701, release pipeline 3007452986, and immutable v2026.10.30. JavaScript MRs !93 and !126 are likewise terminal in v2026.10.29 and v2026.10.29001. None of these releases proves deployment or the final compatible set. Access !189 is terminal in v2026.10.31002; Access !190 at 9618e16530fa4a54eb071c1908045097d1b7a4f0 has a successful exact-head pipeline but remains Draft. Admin topology MR !1418 is likewise Draft at exact source 768f54daa4e00179b55ff1f51fe9a13008154ff0; pipeline 3008952380 passed with warnings because its allowed-failure E2E job failed, so CODEOWNER review and release remain open. KEOPS #2309/#2310 is immutable in v2026.10.31002. Image !398 and generated manifest !399 are merged; supported Nightly pipeline 3012891634 and release pipeline 3012906124 published Image/Helm v2026.10.31 at multi-arch digest sha256:db3aa2e897e2c95e9a30f56156fbf32a1d9a0ca10480e658b75184feff8da020. Its platform SBOMs contain 711 components each. Trivy's block_on=never raw inventory is CRITICAL 6 / HIGH 7 / MEDIUM 20 / LOW 1; it is not finding-free. Deployment remains unobserved. The remaining chain is KEOPS #1333 / !1261 post-Image digest-equality qualification -> Gateway #713 / !188 at be067a74c3b9409fbede8eaec4cd1920a02d9219 -> Product #668 K15 positive/negative E2E -> SDK JS !129 immutable-set requalification. Admin CODEOWNER/release gates and GitOps/GİB environment acceptance remain separate. Do not promote an immutable prerequisite, a Draft, or a predecessor pipeline into final tuple, deployment, verification, or activation evidence.

For ongoing Goal 5 work, read currentPreparation separately from the preserved historical cohorts. On 2026-09-13 it must remain aggregateStatus=BLOCKED with finalImmutableTuple=null: the bounded Attribute #180 implementation is released and adopted by Migration, but product deferred AC01 in the current phase and did not approve the candidate 6,000 ms request budget or 3,769 ms database-query ceiling. #180 remains open at 11/12 with native status Blocked. Migration #209 shows 41/41 checked description items but remains open with native status Blocked; Migration #287 likewise remains open at 10/11 with native status Blocked, so EC11 is not accepted. Existing implementation, release, adoption, and measurement evidence is retained without rerun unless its inputs change or AC01 is reopened. KEOPS #1004 and MR !623 are terminal; release v2026.9.12001 passed pipeline and empty-cache registry read-back, while #1030 remains a separate adjacent follow-up. Technical Docs !27 is a merged preparation baseline, but #121 remains open and In progress at 0/7. Admin Console !966 remains requested-changes, diverged from current develop, and waits for a same-digest real-environment signed ACTIVE receipt. Admin #5079 / MR !991, #5078 / MR !992, and #5082 / MR !994 are terminal merged source integrations with passed final source pipelines. Their retained local, browser, Sonar, AI, and independent-review evidence remains valid, but merge is not Admin Console release or capability activation evidence. #5146 remains a non-blocking follow-up. Distinguish Attribute v2026.9.11002 contract-origin evidence from current provider release v2026.9.12001; attribute the latter to #254/!175 and keep KEOPS #1033 blocked until the release coordinator updates its managed dependency. None of these partial or component-level facts may populate the final tuple. Image !218 is a merged catalog-only update whose automatic mandatory develop jobs passed; the aggregate pipeline is MANUAL because release jobs were deliberately untriggered. It does not prove an image build, release, deployment, #392 completion, or GİB manifest change. Image #395 AC-09 is profile-scoped under note 3824621450: AKS evidence cannot be reused for GİB, which remains UNVERIFIED/BLOCKED pending its independent #443 evidence; approvedTarget remains unset.

Then read the additive phase2CurrentProgress record. At the 2026-09-24 cutoff, Attribute A1/A2/A3 and KEOPS K1/K2/K3 are immutable releases. Release-chain repair #1134 / !724 is released as v2026.9.23002, conditional projection reads #1169 / !758 are released as v2026.9.23004, and K4 #1062 / !714 is released as v2026.9.23005 after exact-head full, GitNexus, Sonar, pipeline and authenticated package read-back passed. Admin !966 and !1052 are merged source integrations, but no Admin release follows from either merge. Reopened Admin #4953 / !1064 is Ready at corrected source b838542d1f61e84910ed49ed3c45536e4e2ca7d7. Exact-head pipeline 2879428625 passed required validation (950 files / 9,481 tests), production build, TypeScript, Sonar Quality Gate (86.4% scoped coverage), zero-finding AI review and 43/43 authenticated Chromium E2E in job 16714129415, including the Defaults and Policies scenario. GitNexus is exact/current at 49,795 nodes and 121,445 edges. All discussions are resolved and the MR is mergeable. CODEOWNER review was re-requested; EC07 exact-head human approval, merge and release remain open. Separate Admin #4279/#5214 browser-acceptance MR !1069 is Ready and mergeable at exact source 4e0e8c249293b27d729f004ac3bddd03d3ef8fb3. Pipeline 2879482114 passed required validation (947 files / 9,426 tests), AI review and 42/42 authenticated E2E; the isolated Chromium harness passed 2/2 for exact membership replacement plus page two and selected-only client UUID submission. This proves the Admin request boundary only. CODEOWNER approval, merge, immutable-image token issuance and ACTIVE remain open. #5214 is 5/5 in In review; #4279 remains 7/8 in Acceptance until the immutable-cohort selected-present/unselected-absent token result and truthful promotion evidence exist. Product Security #257 and T901/#426 are closed historical evidence, not current activation proof and not prerequisites for the approved initial ADVISORY closure; candidate-qualified signed evidence is a later explicit ENFORCED hardening gate. Image !258 adopted KEOPS 2026.9.23005 into the AKS provider catalog. The later Image #395/#577 delivery produced immutable candidate v2026.9.24 at digest sha256:9da0c5ca77b77140dc71b6b38aa9cb342f2cd56e2451792be0d37b165676c004, without deployment. Its first deploy-free #217 attempt failed closed on stale authority and predecessor inputs. Qualification MR !263 fixes only those acceptance sources and is Ready at exact source 4fd2467e24cf1c41b93aa7fdbf13213555126dff; pipeline 2879454266 passed all five jobs, including 29/29 exact-image native projection tests, five startup/provider/default-deny checks and all six lifecycle phases against coherent predecessor v2026.9.23001. The candidate bytes and digest are unchanged. #217 remains open at 11/12 and #392 at 6/9, so this deploy-free result does not populate the accepted final tuple: Image #392 remains BLOCKED, finalImmutableTuple stays null, and there is no deployment observation.

GitOps #419 / !218 is a separate Ready, mergeable and disabled preparation at exact source 448f3d4fddbaa2f1c7239b0e491311525e5287ab. Exact-head validation passed 48 projection, 9 workload- isolation and 31 ASSOS reconciliation tests, all 327 YAML files, compile-all, Helm lint, diff-check and current GitNexus coverage of all 491 files. Pipeline 2879395856 passed every required job; Sonar Quality Gate passed with 80.9% changed-source coverage and zero new findings, vulnerabilities or security hotspots, and AI review has no open finding. Released-image six-phase reconciliation evidence, including retry, rollback, restart, reapply, idempotency and owned-resource cleanup, remains bounded to prior semantic source b7983da1a2f551b05cbdce401086c314a39f4ee3; exact-head tests re-prove the behavior-preserving refactor and template-redaction delta. Ali/DevOps review, merge and separately authorized enablement, deployed read-back and activation remain pending. Do not reinterpret repository readiness or disabled evidence as environment enablement, deployment or activation.

Also inspect phase2CurrentProgress.capabilityTruth.promotionEnforcement. KEOPS #1071 / !662 is released in v2026.9.20001: default ADVISORY preserves an UNAVAILABLE result as a visible warning without adding promotion evidence as a precondition to an independently authorized non-promotion mutation, while explicitly configured ENFORCED blocks every non-ACTIVE result. ADVISORY never authorizes a mutation or weakens its normal authorization checks. ACTIVE remains fail-closed in both modes and requires authenticated and signed ACTIVE, a matching authorized observation, and runtime DEPLOYED. Admin #5166 / !1009 is the terminal merged consumer of the advisory presentation. The mode never changes evidence state or makes API, pipeline, or UI success prove VERIFIED or ACTIVE.

2. Inspect runtime state without promoting it​

Use the released read-only KEOPS capability endpoint for attribute token projection. Treat DEPLOYED, BLOCKED, and DISABLED as values of runtimeState only. The endpoint cannot return or prove the product states VERIFIED or ACTIVE.

3. Inspect projection configuration separately​

Use the per-definition projection read to inspect observable bundles, rules, token surfaces, and native client assignments. This read explains configuration that references one definition; it does not prove an effective value, successful token release, or product activation.

4. Compare immutable identities​

Require the reviewed source commit, release-tag commit, release-pipeline source and aggregate status, validation-job result, package identifiers, and POM/JAR hashes for a released backend cohort. The release-pipeline source must equal the release-tag commit. A passed validation job does not make a failed aggregate pipeline pass. For image evidence, require the exact source tree and image digest. Never combine evidence from different cohorts or substitute a mutable branch for an immutable release.

5. Record the narrowest supported result​

Keep the capability BLOCKED when any required product or environment gate is incomplete. The isolated-local T901 run under GitOps #426 passed its realm-local technical matrix, but it is not a shared-environment or same-image-digest deployment observation. Product Security #257 is historical manager-only acceptance for its recorded digest. It is not candidate-specific target authority. CONFIDENTIAL projection remains disabled and deferred to Security #290.

Do not convert those historical labels into current role requirements. Released Security Management v2026.9.10 retired both dedicated projection roles through !115 and !116, and terminal KEOPS #955/!611 consumed the no-dedicated-projection-role contract. Current administration is temporarily bounded by manage-realm, realm locality, mandatory audit reason, and maker-checker separation. Security #309 tracks a future scoped gate and is not a blocker for this delivery; GitOps #428 tracks only deferred cleanup of the stopped local T901 profile.

6. Keep release-flow scheduling separate from readiness​

Read releaseFlowPolicy as a delivery decision, not capability evidence. Its current value preserves the existing release flow and defers the Pipeline/Image automation transition. The deferred work items remain open, and the decision cannot fill an unpublished release tuple, satisfy an activation gate, or promote BLOCKED to VERIFIED or ACTIVE.

7. Follow the promotion-owner chain​

First read the closureDAG owned by Image #392. Its current closure requires Migration #287 operational acceptance, Image #217 final exact-image acceptance, and GitOps #419 existing-realm reconciliation. Closed Image #395 and #577 provide the released candidate evidence for #217. The same-digest deploy-free acceptance now passes on Ready MR !263, but #217 remains an open closure node until that qualification is integrated and the umbrella status is reconciled. Security #257 historical acceptance cannot satisfy any current closure gate.

Use GitOps #429 as the owner of the signed keops.attribute-projection-promotion/v1 attestation. Its signed VERIFIED phase does not require a deployment observation. Its signed ACTIVE phase does require an authorized matching deployment observation.

The producer implementation is complete: #429 is closed and GitOps !217 is merged at d5f237472dce53e5ad0a6cfea51bb18d3354b194. Its MR validation passed seven jobs, and the merged-source validation passed five validation jobs; the two optional release-branch jobs were not run. This is a source-only producer delivery, not a product image release or an operational signing run.

In the product evidence record, promotionOwnership.signedAttestation.state=PENDING and activationGates.signedPromotionAttestation=PENDING describe the missing candidate-qualified attestation, not unfinished #429 code. Keep both pending until the actual matching evidence exists. The delivered producer removed #894's implementation dependency. Merged KEOPS !566 and immutable v2026.9.5 now provide the fail-closed consumer, but without actual candidate-qualified signed evidence its operational result remains UNAVAILABLE and governed Console controls remain disabled.

Use the authenticated, fail-closed KEOPS read model owned by KEOPS #894 for the consumer state. It returns UNAVAILABLE, VERIFIED, or ACTIVE; only ACTIVE requires signed ACTIVE, the matching observation, and live #684 runtimeState=DEPLOYED. Console #4279 consumes that result and enables governed controls only for exact ACTIVE.

Image #392 remains the immutable assembly/handoff and closure-DAG record; it is not a signer or promoter. Keep the current historical aggregate record BLOCKED with deploymentObservation=NOT_OBSERVED while its #287/#217/#419 gates or the promotion-owner gates are pending. Do not infer its current status from the future API vocabulary.

Migration and Technical Ownership​

Product documentation owns operator-visible terminology, state interpretation, and safe migration expectations. The exact provider dependency order, API compatibility matrix, rollout/rollback procedure, and release-by-release technical migration evidence belong to Technical Docs #121.

During an upgrade:

  • keep existing direct reads under the Direct Values name;
  • do not label a default or applicability record as an Effective Value;
  • keep stable definitionId separate from semantic definitionKey;
  • preserve ETag/If-Match behavior on supported mutations; and
  • leave Defaults and Policies or Effective Values disabled until the installed immutable backend cohort and product evidence explicitly support them.

Migration v2026.9.11001 proves the released #287 implementation, not EC11 acceptance. Keep EC11 open while Attribute #180 and Migration #209 remain incomplete.

An administrative exact-membership input, if the released contract supports one, remains typed simulation/inspection evidence. It is not Session Management selected-context state and cannot be used to authorize a runtime policy or token.

This handoff does not prescribe an environment deployment. Follow the separately authorized release and operations procedure for the target environment.

Validation Scenario​

Candidate-specific acceptance boundary​

Do not reuse T901 #426 as acceptance of the v2026.9.1001 candidate: its isolated-local run used the distinct predecessor 2026.8.29002. Historical Security #257 acceptance also needs explicit qualification for the candidate digest. Keep both historical completions intact and obtain the candidate-specific evidence required by GitOps #429; do not infer applicability from a closed issue, a green image job, or synthetic publisher tests. See the immutable evidence and identity proof.

Scenario​

A support engineer receives a successful response from the runtime capability endpoint while the product manifest remains BLOCKED and has no deployment observation.

Expected Result​

The engineer records the runtime components as available and the product capability as BLOCKED. No screen, release note, or support response calls the capability VERIFIED or ACTIVE.

How to Verify​

  • Runtime evidence: the endpoint returns only the bounded runtime-state vocabulary.
  • Product evidence: the immutable record retains every incomplete blocker.
  • Release evidence: every released row separates reviewed source, release-tag commit, aggregate pipeline status, validation-job result, package, and artifact-hash data.
  • Audit evidence: the support record contains identifiers and reason codes, not attribute values, tokens, credentials, or user details.

Troubleshooting​

  • Runtime is DEPLOYED but product is BLOCKED — keep the product result BLOCKED; complete the named evidence gates instead of promoting the runtime result.
  • Release identities do not match — stop the comparison and select one immutable cohort.
  • The backend row is unpublished — keep all release, pipeline, package, and hash placeholders empty and keep the dependent capability blocked.
  • The automation transition is deferred — continue using the unchanged release flow, keep the deferred work items open, and make no readiness inference from the scheduling decision.
  • Promotion state is unavailable — #429's producer and the KEOPS #894 consumer are delivered, but an actual candidate-qualified attestation is absent, so the fail-closed result remains UNAVAILABLE and Console #4279 cannot enable governed controls. Do not read GitOps or image records directly in the browser, or mark product evidence ready because either implementation issue is closed.
  • Signed VERIFIED has no deployment observation — keep the consumer state VERIFIED; this is a valid pre-deployment state, not missing ACTIVE evidence.
  • A successful API request appears to prove activation — use the product evidence record; request success is not capability evidence.

Next Steps​

Use Attribute Capability Status for the current matrix or follow Attribute Capability Status Troubleshooting when runtime and product evidence disagree.

Attribute Capability Status

Review current product status and immutable evidence.

Attribute Values and Resolution

Separate direct, policy-input, and effective views.

Admin Console Attribute Workflows

Apply the evidence boundary to administration screens.

Capability Troubleshooting

Diagnose inconsistent or incomplete attribute evidence.