Full CRD Spec · ADMIT/DENY/WATCH Trinary · 8 Trial Phases · SOSTLE-Aware Severity
γ₁ = 14.134725141734693 · mefine-static · pemos.ca
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
name: trendaltrials.pemos.io
spec:
group: pemos.io
scope: Namespaced
names:
plural: trendaltrials
singular: trendaltrial
kind: TrendalTrial
shortNames: ["tt"]
versions:
- name: v1alpha1
served: true
storage: true
schema:
openAPIV3Schema:
type: object
properties:
spec:
type: object
required: [subject, trialClass, gates]
properties:
subject:
type: object
properties:
kind: { type: string } # Pod, Deployment, Image
name: { type: string }
namespace: { type: string }
imageRef: { type: string }
gitSHA: { type: string }
trialClass:
type: string
enum: [ADMISSION, RUNTIME, INCIDENT, COMPLIANCE]
gates:
type: object
properties:
conftest: { type: boolean, default: true }
trivy: { type: boolean, default: true }
kyverno: { type: boolean, default: true }
gatekeeper: { type: boolean, default: true }
falco: { type: boolean, default: true }
laamMode:
type: string
enum: [INGEST, VALIDATE, BOTH]
default: BOTH
gamma1:
type: number
default: 14.134725141734693
status:
type: object
properties:
phase:
type: string
enum: [Pending, Gathering, Gating, Witnessing,
Scoring, Reviewing, Deciding, Complete]
verdict:
type: string
enum: [ADMIT, DENY, WATCH]
score: { type: number }
gateResults:
type: object
additionalProperties:
type: object
properties:
passed: { type: boolean }
weight: { type: number }
detail: { type: string }
falcoEvents:
type: array
items: { type: string }
soslteLevel: { type: integer }
rekorUUID: { type: string }
immudbTxID: { type: integer }
certificateRef:{ type: string }
gamma1Stamp: { type: number }
completedAt: { type: string, format: date-time }
Falco carries 35% of total score weight. A kernel witness outranks all static analysis gates combined. CRITICAL Falco events trigger automatic DENY regardless of other scores.
First-pass collection: fetch manifests, pull logs, snapshot Prometheus state. No scoring. No judgment. Pure evidence gathering. Runs during phases 1-3. Designed to be non-blocking — the cluster is not yet affected.
phases 1-3 non-blocking read-onlySecond-pass scoring: all collected evidence fed into PEMLAAM graph. Gate weights applied. Falco severity modifiers computed. Composite score derived. Verdict logic runs. Runs during phases 5-7. May block admission.
phases 5-7 scoring active may block| SOSTLE LEVEL | NAME | FALCO THRESHOLD | SCORE MODIFIER | DEFAULT VERDICT |
|---|---|---|---|---|
| L0 | Clear | INFO only | +0.10 | ADMIT |
| L1 | Nominal | WARNING acceptable | ±0.00 | ADMIT |
| L2 | Elevated | ERROR triggers review | -0.10 | WATCH |
| L3 | Incident | CRITICAL triggers DENY | -0.25 | WATCH/DENY |
| L4 | Crisis | Any Falco event = DENY | -0.40 | DENY |
| L5 | Gated | CLO bench required | manual | CLO review |
apiVersion: pemos.io/v1alpha1
kind: TrendalCertificate
metadata:
name: cert-{trialName}-{epoch}
namespace: pemos-system
spec:
trialRef: {trialName}
subject:
kind: Pod | Deployment | Image
name: {name}
namespace: {namespace}
imageRef: {registry}/{image}@sha256:{digest}
gitSHA: {commit}
verdict: ADMIT | DENY | WATCH
score: 0.00-1.00
soslteLevel: 0-5
gateResults:
conftest: { passed: bool, weight: 0.15, detail: str }
trivy: { passed: bool, weight: 0.15, detail: str }
kyverno: { passed: bool, weight: 0.15, detail: str }
gatekeeper: { passed: bool, weight: 0.20, detail: str }
falco: { passed: bool, weight: 0.35, detail: str }
rekorUUID: {rekor-transparency-log-uuid}
immudbTxID: {integer}
gamma1Stamp: 14.134725141734693
issuedAt: {RFC3339}
expiresAt: {RFC3339} # 90 days default
certHash: sha256:{hash-of-full-cert}