555 lines
32 KiB
Markdown
555 lines
32 KiB
Markdown
## Pack 18 — Environment Detail standardized: **Deploy + SBOM + Crit‑Reachable + Hybrid B/I/R + Data Confidence** in one header (consistent everywhere)
|
||
|
||
This pack makes **Environment Detail** the single place where an operator or approver can answer:
|
||
**“Is this environment safe to promote into right now?”**
|
||
…without bouncing across Dashboard → Security → Ops → Integrations.
|
||
|
||
It keeps your IA intact:
|
||
|
||
* **Release Control** is still a root menu
|
||
* **Regions-first** environment organization remains
|
||
* **Reachability stays 2nd-class** (tab + badges), not a new top-level area
|
||
* **Data Integrity** remains owned by Ops, but is summarized here
|
||
|
||
---
|
||
|
||
# 18.1 Menu & entry graph (Mermaid)
|
||
|
||
```mermaid
|
||
flowchart TD
|
||
RC[Release Control (ROOT)] --> RE[Regions & Environments]
|
||
RE --> RD[Region Detail]
|
||
RD --> ENV[Environment Detail]
|
||
|
||
%% Entry points
|
||
DASH[Dashboard] --> ENV
|
||
APPR[Approvals] --> ENV
|
||
REL[Releases] --> ENV
|
||
|
||
%% Cross links out of env
|
||
ENV --> BV[Bundle Version Detail]
|
||
ENV --> RUN[Promotion Run Timeline]
|
||
ENV --> FIND[Security Findings (filtered)]
|
||
ENV --> DI[Ops: Data Integrity (filtered)]
|
||
ENV --> INT[Integrations Hub]
|
||
ENV --> GOV[Release Control: Governance]
|
||
ENV --> EVID[Evidence Export]
|
||
```
|
||
|
||
---
|
||
|
||
# 18.2 Environment Detail (shell) — the standardized “single header truth”
|
||
|
||
### Formerly (what it was called before)
|
||
|
||
* **Control Plane pipeline node** (no dedicated environment page), plus
|
||
* **Settings → Release Control → Environments** (flat listing; not region-first)
|
||
|
||
### Why changed like this
|
||
|
||
You asked for:
|
||
|
||
* per-environment status including **docker/runtime** *and* **image SBOM status**
|
||
* dashboard surfacing of “**X envs with critical reachable issues**”
|
||
* nightly pipeline failures (rescan / feed sync / integration connectivity)
|
||
* hybrid reachability from **image/build/runtime**
|
||
All of those converge at the environment boundary, so Env Detail needs a uniform “truth header”.
|
||
|
||
---
|
||
|
||
## Environment Detail shell graph (Mermaid)
|
||
|
||
```mermaid
|
||
flowchart TD
|
||
ENV[Environment Detail (shell)] --> O[Overview]
|
||
ENV --> DEP[Deploy Status]
|
||
ENV --> SB[SBOM & Findings]
|
||
ENV --> RCH[Reachability (Hybrid B/I/R)]
|
||
ENV --> INP[Inputs (Vault/Consul)]
|
||
ENV --> PR[Promotions & Approvals]
|
||
ENV --> DC[Data Confidence]
|
||
ENV --> EV[Evidence & Audit]
|
||
```
|
||
|
||
---
|
||
|
||
## ASCII mock — Environment Detail shell (header + tabs)
|
||
|
||
```text
|
||
┌──────────────────────────────────────────────────────────────────────────────────────────────┐
|
||
│ Environment: us-prod Region: US-East Type: Production │
|
||
│ Formerly: Control Plane pipeline node (no dedicated page) + Settings ▸ Release Control ▸ Envs │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ STANDARD STATUS HEADER (shown consistently on every Env tab) │
|
||
│ Deploy: DEGRADED (targets 5/6 healthy) | SBOM: STALE (26h) scanned 13/14 pending 1 │
|
||
│ Findings (target env): CritR=2 HighR=0 HighNR=3 VEX=62% │
|
||
│ Hybrid reach coverage: Build 78% | Image 100% | Runtime 35% (evidence age: B 7h / I 1h / R 26h)│
|
||
│ Data Confidence: WARN (NVD stale 3h; SBOM rescan FAIL; Jenkins DEGRADED; DLQ runtime 1,230) │
|
||
│ Policy baseline: Prod-US-East Version lock: lock-2026-02-18 │
|
||
│ Deployed bundle: Platform Release 1.3.0-rc1 (manifest sha256:beef...) │
|
||
│ Quick links: [Open Deployed Bundle] [Open Findings] [Open Data Integrity] [Open Promotion Run] │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ Tabs: [Overview] [Deploy Status] [SBOM & Findings] [Reachability] [Inputs] [Promotions] [Data] │
|
||
│ [Evidence & Audit] │
|
||
└──────────────────────────────────────────────────────────────────────────────────────────────┘
|
||
```
|
||
|
||
---
|
||
|
||
# 18.3 Tab — Overview (env “situation report”)
|
||
|
||
### Formerly
|
||
|
||
* Mixed across:
|
||
|
||
* **Control Plane** (pipeline + active deployments),
|
||
* **Security Overview** (global),
|
||
* **Platform Health** (platform-wide),
|
||
* **Approvals** (per-promotion)
|
||
|
||
### Why changed like this
|
||
|
||
Overview becomes a decision “brief”:
|
||
|
||
* what is deployed,
|
||
* what is pending,
|
||
* what is blocking promotions,
|
||
* what’s changed in the last 24h.
|
||
|
||
---
|
||
|
||
## Overview graph (Mermaid)
|
||
|
||
```mermaid
|
||
flowchart TD
|
||
O[Env Overview] --> CUR[Current deployed bundle + digests]
|
||
O --> PEND[Pending approvals affecting this env]
|
||
O --> ACT[Active/Recent promotion runs]
|
||
O --> TOP[Top risks (CritR + stale SBOM + stale feeds)]
|
||
O --> ACTIONS[Recommended actions (scan/rescan/rotate token/request exception)]
|
||
O --> LINKS[Links: Findings, Data Integrity, Inputs, Run Timeline, Evidence]
|
||
```
|
||
|
||
---
|
||
|
||
## ASCII mock — Overview
|
||
|
||
```text
|
||
┌──────────────────────────────────────────────────────────────────────────────────────────────┐
|
||
│ Overview │
|
||
│ Formerly: Control Plane summary + scattered Security/Ops context │
|
||
├───────────────────────────────────────────────────────────────────────────────┬──────────────┤
|
||
│ Current deployment │ Actions │
|
||
│ Bundle: Platform Release 1.3.0-rc1 (manifest sha256:beef...) │ [Trigger SBOM │
|
||
│ Last promoted: Feb 18, 08:33 by alice.johnson │ rescan] │
|
||
│ Components: 14 images (13 scanned, 1 pending) │ [Retry NVD │
|
||
│ │ sync] │
|
||
│ Promotion posture │ [Open Inputs]│
|
||
│ Pending approvals: 1 (BLOCK) │ [Open Run] │
|
||
│ Active runs: 0 │ [Export Env │
|
||
│ Next scheduled: nightly hotfix window 02:00 │ Snapshot] │
|
||
├───────────────────────────────────────────────────────────────────────────────┴──────────────┤
|
||
│ Top risks (last 24h) │
|
||
│ 1) Crit reachable CVE-2026-1234 (user-service) → no VEX │
|
||
│ 2) SBOM stale 26h (nightly rescan failing) │
|
||
│ 3) Runtime reachability evidence 35% (agent degraded) │
|
||
│ Links: [Open Findings filtered to env] [Open Data Integrity filtered to env] │
|
||
└──────────────────────────────────────────────────────────────────────────────────────────────┘
|
||
```
|
||
|
||
---
|
||
|
||
# 18.4 Tab — Deploy Status (runtime / docker / targets + services)
|
||
|
||
### Formerly
|
||
|
||
* Best approximation:
|
||
|
||
* **Platform Health** (platform-wide),
|
||
* dashboard pipeline node “Deploy status”
|
||
* and external systems.
|
||
|
||
### Why changed like this
|
||
|
||
You explicitly want env summary to include **docker/runtime**, but it must be coupled with SBOM and risk, not isolated.
|
||
|
||
---
|
||
|
||
## Deploy Status graph (Mermaid)
|
||
|
||
```mermaid
|
||
flowchart TD
|
||
DEP[Deploy Status] --> TGT[Targets health table]
|
||
DEP --> SVC[Services/Workloads status]
|
||
DEP --> DRIFT[Config drift vs expected bundle manifest]
|
||
DEP --> LOGS[Links to run logs / agent logs]
|
||
DEP --> RUN[Open latest promotion run timeline]
|
||
```
|
||
|
||
---
|
||
|
||
## ASCII mock — Deploy Status
|
||
|
||
```text
|
||
┌──────────────────────────────────────────────────────────────────────────────────────────────┐
|
||
│ Deploy Status │
|
||
│ Formerly: Platform Health + implicit “docker status” in Control Plane pipeline │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ Targets (US-East/us-prod) │
|
||
│ ┌───────────────┬───────────┬──────────────┬───────────────┬───────────────────────────────┐ │
|
||
│ │ Target │ Agent │ Health │ Last Heartbeat │ Notes │ │
|
||
│ ├───────────────┼───────────┼──────────────┼───────────────┼───────────────────────────────┤ │
|
||
│ │ docker-us-01 │ agent-01 │ ✓ HEALTHY │ 1m ago │ ok │ │
|
||
│ │ docker-us-02 │ agent-02 │ ✓ HEALTHY │ 2m ago │ ok │ │
|
||
│ │ docker-us-03 │ agent-03 │ ✗ DEGRADED │ 12m ago │ disk pressure │ │
|
||
│ └───────────────┴───────────┴──────────────┴───────────────┴───────────────────────────────┘ │
|
||
│ │
|
||
│ Services (from deployed bundle manifest) │
|
||
│ api-gateway RUNNING ✓ digest sha256:1111... replicas 4/4 │
|
||
│ user-service RUNNING ✓ digest sha256:2222... replicas 3/3 │
|
||
│ worker RUNNING ✓ digest sha256:4444... replicas 1/1 │
|
||
│ web-frontend WARN ⚠ digest sha256:3333... error rate 1.4% │
|
||
│ Links: [Open last Promotion Run] [Open agent logs] │
|
||
└──────────────────────────────────────────────────────────────────────────────────────────────┘
|
||
```
|
||
|
||
---
|
||
|
||
# 18.5 Tab — SBOM & Findings (deploy inventory + scan freshness + reachable breakdown)
|
||
|
||
### Formerly
|
||
|
||
* **Security → Overview / Findings / Vulnerabilities**
|
||
but not env-attached and not surfaced alongside SBOM freshness.
|
||
|
||
### Why changed like this
|
||
|
||
This is where you get exactly what you asked for:
|
||
|
||
* “no issues” vs “env with critical reachable issues”
|
||
* the deployed images list with **SBOM scan status** and **freshness**
|
||
* “reachable” classification remains visible but not a new product area
|
||
|
||
---
|
||
|
||
## SBOM & Findings graph (Mermaid)
|
||
|
||
```mermaid
|
||
flowchart TD
|
||
SB[SBOM & Findings] --> INV[Deployed inventory (digests)]
|
||
SB --> SCAN[SBOM scan status/freshness per digest]
|
||
SB --> SUM[Findings summary CritR/HighR/HighNR + VEX]
|
||
SB --> TOP[Top CVEs/packages (filtered)]
|
||
SB --> DRILL[Drill: Finding detail / Component version detail]
|
||
SB --> EX[Exceptions/VEX actions]
|
||
```
|
||
|
||
---
|
||
|
||
## ASCII mock — SBOM & Findings
|
||
|
||
```text
|
||
┌──────────────────────────────────────────────────────────────────────────────────────────────┐
|
||
│ SBOM & Findings │
|
||
│ Formerly: Security ▸ Findings / Vulnerabilities (global, not env-attached) │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ Findings summary (this env) │
|
||
│ Crit reachable: 2 High reachable: 0 High not reachable: 3 VEX coverage: 62% │
|
||
│ SBOM freshness: WARN (26h) Missing SBOM: 0 Pending scan: 1 │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ Deployed inventory (digest-first) │
|
||
│ ┌───────────────┬───────────────┬───────────────────────┬─────────────┬─────────────────────┐ │
|
||
│ │ Component │ Version label │ Digest │ SBOM status │ Findings (CritR) │ │
|
||
│ ├───────────────┼───────────────┼───────────────────────┼─────────────┼─────────────────────┤ │
|
||
│ │ api-gateway │ 2.1.0 │ sha256:1111... │ OK (2h) │ 0 │ │
|
||
│ │ user-service │ 3.0.0-rc1 │ sha256:2222... │ OK (26h) │ 2 │ │
|
||
│ │ worker │ 3.1.0 │ sha256:4444... │ PENDING │ — │ │
|
||
│ └───────────────┴───────────────┴───────────────────────┴─────────────┴─────────────────────┘ │
|
||
│ Top issues (click to drill) │
|
||
│ - CVE-2026-1234 openssl user-service reachable (no VEX) │
|
||
│ - CVE-2026-9001 log4j api-gateway not reachable (VEX present) │
|
||
│ Actions: [Trigger SBOM scan/rescan] [Open Findings] [Open VEX/Exceptions] │
|
||
└──────────────────────────────────────────────────────────────────────────────────────────────┘
|
||
```
|
||
|
||
---
|
||
|
||
# 18.6 Tab — Reachability (Hybrid B/I/R matrix + evidence age; still 2nd-class)
|
||
|
||
### Formerly
|
||
|
||
* Mentioned in approvals/policy but not consistently visible per environment.
|
||
|
||
### Why changed like this
|
||
|
||
You require reachability evidence from:
|
||
|
||
* **image scan (Dover)**
|
||
* **build**
|
||
* **running environment**
|
||
This tab makes the evidence **explicit**, shows coverage and age, and links to the ingest health (Ops) when missing.
|
||
|
||
---
|
||
|
||
## Reachability graph (Mermaid)
|
||
|
||
```mermaid
|
||
flowchart TD
|
||
RCH[Reachability] --> COV[Coverage Build/Image/Runtime]
|
||
RCH --> AGE[Evidence age + confidence]
|
||
RCH --> MAT[Per-component B/I/R matrix]
|
||
RCH --> DRILL[Drill: component reachability view]
|
||
RCH --> OPS[Link: Ops Data Integrity → Reachability ingest health]
|
||
```
|
||
|
||
---
|
||
|
||
## ASCII mock — Reachability
|
||
|
||
```text
|
||
┌──────────────────────────────────────────────────────────────────────────────────────────────┐
|
||
│ Reachability (Hybrid) │
|
||
│ Formerly: partial signal in approvals; no consistent per-env view │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ Coverage: Build 78% | Image 100% | Runtime 35% │
|
||
│ Evidence age: Build 7h | Image 1h | Runtime 26h │
|
||
│ Policy interpretation (baseline Prod-US-East): │
|
||
│ - Runtime coverage < 50% → WARN (reduces confidence) │
|
||
│ - Crit reachable requires runtime evidence OR VEX override → may BLOCK │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ Component matrix │
|
||
│ api-gateway sha256:1111... Build ✓ Image ✓ Runtime ✗ │
|
||
│ user-service sha256:2222... Build ✗ Image ✓ Runtime ✗ │
|
||
│ web-frontend sha256:3333... Build ✓ Image ✓ Runtime ✓ │
|
||
│ Links: [Open Reachability Ingest Health] [Open component version details] │
|
||
└──────────────────────────────────────────────────────────────────────────────────────────────┘
|
||
```
|
||
|
||
---
|
||
|
||
# 18.7 Tab — Inputs (Vault/Consul bindings + materialization readiness)
|
||
|
||
### Formerly
|
||
|
||
* Split across:
|
||
|
||
* Integrations (Vault),
|
||
* environment setup details (not consistently visible),
|
||
* promotion-time failures.
|
||
|
||
### Why changed like this
|
||
|
||
This is critical for the bundle organizer workflow:
|
||
If bindings are missing, **materialization and promotions must block early**, not fail at deploy time.
|
||
|
||
---
|
||
|
||
## Inputs graph (Mermaid)
|
||
|
||
```mermaid
|
||
flowchart TD
|
||
INP[Inputs] --> BIND[Bindings (Vault/Consul) per required var]
|
||
INP --> MISS[Missing bindings + suggested fixes]
|
||
INP --> OV[Overrides (env-specific)]
|
||
INP --> MAT[Materialization readiness for bundle versions]
|
||
INP --> INT[Link: Integrations (Vault/Consul)]
|
||
```
|
||
|
||
---
|
||
|
||
## ASCII mock — Inputs
|
||
|
||
```text
|
||
┌──────────────────────────────────────────────────────────────────────────────────────────────┐
|
||
│ Inputs (Vault/Consul) │
|
||
│ Formerly: implicit env config + external Vault/Consul management │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ Binding status (required vars from bundle contracts) │
|
||
│ api-gateway │
|
||
│ - RATE_LIMIT_MAX consul key: service/api-gw/rate_limit_max ✓ bound │
|
||
│ - JWT_PUBLIC_KEYS vault path: secret/api-gw/jwt_keys ✓ bound (sealed) │
|
||
│ user-service │
|
||
│ - DB_PASSWORD vault path: secret/user/db_password ✗ MISSING binding │
|
||
│ │
|
||
│ Impact: promotions using this env will BLOCK at “Materialize Inputs” │
|
||
│ Fix: [Bind missing var] (opens mapping editor) │
|
||
│ Links: [Open Vault integration] [Open Consul integration] │
|
||
└──────────────────────────────────────────────────────────────────────────────────────────────┘
|
||
```
|
||
|
||
---
|
||
|
||
# 18.8 Tab — Promotions & Approvals (env-centric history + what’s pending)
|
||
|
||
### Formerly
|
||
|
||
* Promotions were visible under Releases list, approvals under Approvals list, but env-centric “what’s pending for *this env*” wasn’t first-class.
|
||
|
||
### Why changed like this
|
||
|
||
Operators need an env-centric view:
|
||
|
||
* what bundle versions landed here,
|
||
* what is currently running,
|
||
* what approvals are blocked,
|
||
* and what changed between deployed and proposed.
|
||
|
||
---
|
||
|
||
## Promotions & Approvals graph (Mermaid)
|
||
|
||
```mermaid
|
||
flowchart TD
|
||
PR[Promotions & Approvals] --> PEND[Pending approvals targeting this env]
|
||
PR --> RUNS[Recent promotion runs (timeline links)]
|
||
PR --> DIFF[Diff proposed vs deployed bundle version]
|
||
PR --> EVID[Evidence links per run]
|
||
PR --> REL[Link: Releases filtered to this env]
|
||
PR --> APPR[Link: Approvals filtered to this env]
|
||
```
|
||
|
||
---
|
||
|
||
## ASCII mock — Promotions & Approvals
|
||
|
||
```text
|
||
┌──────────────────────────────────────────────────────────────────────────────────────────────┐
|
||
│ Promotions & Approvals │
|
||
│ Formerly: separate Releases list + Approvals list; env-centric view missing │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ Pending approvals (this env) │
|
||
│ - Platform Release 1.3.0-rc1 → us-prod Gates: BLOCK (CritR + SBOM pending) [Open Approval] │
|
||
│ │
|
||
│ Recent promotions │
|
||
│ Feb 18 08:33 Hotfix Bundle 1.2.4 Status: DEPLOYED [Open Run] [Evidence] │
|
||
│ Feb 11 02:10 Platform Release 1.2.3 Status: DEPLOYED [Open Run] [Evidence] │
|
||
│ │
|
||
│ Diff (proposed vs deployed) │
|
||
│ Proposed: Platform 1.3.0-rc1 vs Deployed: Hotfix 1.2.4 │
|
||
│ Changed components: user-service, api-gateway │
|
||
│ [Open Diff] │
|
||
└──────────────────────────────────────────────────────────────────────────────────────────────┘
|
||
```
|
||
|
||
---
|
||
|
||
# 18.9 Tab — Data Confidence (env-scoped slice of Ops: Data Integrity)
|
||
|
||
### Formerly
|
||
|
||
* Data issues existed, but approvers/operators had to jump out to Ops/Settings.
|
||
|
||
### Why changed like this
|
||
|
||
This tab makes the environment’s security posture honest:
|
||
|
||
* If feeds are stale or rescans failing, the env’s “SBOM status” is not reliable.
|
||
* This is *not* duplicating Ops; it’s an env-scoped summary with deep links.
|
||
|
||
---
|
||
|
||
## Data Confidence graph (Mermaid)
|
||
|
||
```mermaid
|
||
flowchart TD
|
||
DC[Data Confidence] --> FEED[Feeds freshness (env/region scoped)]
|
||
DC --> JOB[Relevant jobs (rescan, reachability ingest)]
|
||
DC --> INT[Integrations relevant to this env]
|
||
DC --> DLQ[DLQ counts affecting this env]
|
||
DC --> LINK[Open Ops Data Integrity (filtered)]
|
||
```
|
||
|
||
---
|
||
|
||
## ASCII mock — Data Confidence
|
||
|
||
```text
|
||
┌───────────────────────────────────────────────────────────────────────────────┐
|
||
│ Data Confidence │
|
||
│ Formerly: Ops Feeds + System Jobs + Integrations (manual correlation) │
|
||
├───────────────────────────────────────────────────────────────────────────────┤
|
||
│ Feeds (region: US-East) │
|
||
│ OSV OK (20m) NVD WARN (3h) KEV OK (3h) │
|
||
│ Jobs impacting this env │
|
||
│ sbom-nightly-rescan: FAIL → 12 deployed digests stale > 24h │
|
||
│ reachability-runtime-ingest: WARN → runtime evidence age 26h │
|
||
│ Integrations │
|
||
│ Registry WARN (token expiry soon) Jenkins DEGRADED Vault OK Consul OK │
|
||
│ DLQ │
|
||
│ runtime-ingest bucket: 1,230 │
|
||
│ Link: [Open Ops → Data Integrity (US-East + us-prod filter)] │
|
||
└───────────────────────────────────────────────────────────────────────────────┘
|
||
```
|
||
|
||
---
|
||
|
||
# 18.10 Tab — Evidence & Audit (env snapshot export + last proof chain refs)
|
||
|
||
### Formerly
|
||
|
||
* Evidence existed globally:
|
||
|
||
* Evidence Bundles
|
||
* Export
|
||
* Proof Chains
|
||
But env-centric export (“give me the state of us-prod at time T”) wasn’t obvious.
|
||
|
||
### Why changed like this
|
||
|
||
Auditors often ask for:
|
||
|
||
* evidence for a release *and* the resulting deployed state in the env
|
||
This tab provides env snapshot exports and links to the latest promotion evidence packs.
|
||
|
||
---
|
||
|
||
## Evidence & Audit graph (Mermaid)
|
||
|
||
```mermaid
|
||
flowchart TD
|
||
EV[Evidence & Audit] --> SNAP[Export Env Snapshot]
|
||
EV --> LAST[Latest promotion evidence pack]
|
||
EV --> CHAIN[Proof chain refs (if sealed)]
|
||
EV --> AUDIT[Env audit trail (who changed inputs/bindings/policy)]
|
||
EV --> EXPORT[Open Evidence Export Center]
|
||
```
|
||
|
||
---
|
||
|
||
## ASCII mock — Evidence & Audit
|
||
|
||
```text
|
||
┌──────────────────────────────────────────────────────────────────────────────────────────────┐
|
||
│ Evidence & Audit │
|
||
│ Formerly: Evidence pages existed, but env-centric exports were not obvious │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ Export options │
|
||
│ [Export Env Snapshot] includes: deployed bundle manifest, digests, SBOM status, findings, │
|
||
│ reachability summary, data confidence snapshot, timestamps │
|
||
│ │
|
||
│ Latest promotion evidence │
|
||
│ Hotfix Bundle 1.2.4 → us-prod evidence-pack.tar.gz (sealed) [Open] [Download] │
|
||
│ Proof chain refs: chain-9912 (valid) │
|
||
│ Audit trail (env config): │
|
||
│ - Feb 18 07:10: Vault token rotated (registry rescan recovered) │
|
||
│ - Feb 18 06:40: baseline changed Prod-US-East (gate tightened) │
|
||
│ Link: [Open Evidence Export Center] │
|
||
└──────────────────────────────────────────────────────────────────────────────────────────────┘
|
||
```
|
||
|
||
---
|
||
|
||
## What this pack accomplishes (directly matching your requirements)
|
||
|
||
* Every environment now shows **deploy health + image SBOM status** together (not separate worlds).
|
||
* The environment header includes:
|
||
|
||
* **Crit reachable** and reachable-class breakdown
|
||
* **Hybrid reachability B/I/R** + evidence age
|
||
* **Data Confidence** derived from nightly jobs, feed freshness, integrations, DLQ
|
||
* Approvals/Releases/Dashboard can link to Env Detail and always show the same standardized status strip.
|
||
|
||
---
|
||
|
||
If you want to continue, **Pack 19** can consolidate the Security area so “Findings / Vulnerabilities / SBOM Lake / SBOM Graph / VEX / Exceptions” are organized around **release decisions + audit outputs** (keeping reachability second-class and preserving all the PoC screens).
|