Skip to content

docs(compliance): hub row says enforce_admins is on for main (AIFactory#2014) #3677

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
olafkfreund merged 2 commits into from
Nov 7, 2026
Merged

docs(compliance): hub row says enforce_admins is on for main (AIFactory#2014) #3677

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1f3e3ef
docs(compliance): hub row says enforce_admins is on for main (AIFacto…
olafkfreund Nov 7, 2026
09a5911
Merge branch 'main' into docs/2014-hub-enforce-admins-row
olafkfreund Nov 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/compliance/control-matrix.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ as separate columns here.
| Audit logging | Hash-chain + daily signed anchor + air-gapped verifier | Background/WS events unchained; no SIEM forward; no security alerting | #313 |
| Encryption at rest | TLS at Cloudflare edge; agenix host key | Postgres PV not encrypted (R-014, accepted to 2027-04-24); no KMS; cluster-internal cleartext | #314 |
| Secrets management | agenix + cred-broker rotation; `scan_secrets.py`; gitleaks required check | Manual agenix rotation accepted (R-016, review 2027-04-24); runbook in encryption-key-mgmt.md; inventory in factory-gitops docs/secrets-management.md; SOPS claim not real | #315 |
| Change mgmt & SoD | PR flow, CI gates, Fides change-gate (built); merge autonomy: [generated autonomy matrix + control mapping](https://aifactory.freundcloud.com/compliance/autonomy-matrix) (#1962) | Direct-to-main gitops auto-deploy; branch protection with required checks on all four service repos (and factory-gitops), but `enforce_admins` off, so an admin can merge past a red check via the API (#943); Fides unwired | #316 |
| Change mgmt & SoD | PR flow, CI gates, Fides change-gate (built); merge autonomy: [generated autonomy matrix + control mapping](https://aifactory.freundcloud.com/compliance/autonomy-matrix) (#1962) | Direct-to-main gitops auto-deploy; branch protection with required checks on all four service repos (and factory-gitops); `enforce_admins` is on for `main` in the four service repos and Factory since 2026-10-22, but off on every `dev` branch and on factory-gitops `main`, where an admin can still merge past a red check via the API (#943, AIFactory#2014); Fides unwired | #316 |
| Vuln & patch mgmt | CodeQL x5, Trivy P0 gate, Dependabot base-image updates x4; remediation SLA + vulnerability register documented | CFactory even-coverage in flight (CFactory#191); external pen test not run, accepted risk R-015 (review 2027-04-24); factory-gitops agent-CLI pins unmanaged (#436 gap #7) | #317 |
| Supply-chain integrity | Cosign + dual SBOM on all four image repos; Kyverno Enforce admission gate; SLSA Build L2 target | Admission is failurePolicy Ignore, tag-based, no SBOM-attestation rule; deploy-path provenance mode not explicit; signed commits; no L3 claim | #318 |
| Incident response | SECURITY.md disclosure; audit chain for forensics | No IR runbook wired to alerting; untested; no paging | #319 |
Expand Down
Loading