The Probe is a customer-controlled read-side service. It receives a signed, expiring observation request, reads an allowlisted target, evaluates a narrow expected predicate, signs an attestation, and stores raw observations only in its encrypted local queue.
Security contract
- The Probe accepts only strict canonical v0.2 requests signed by a certified
server_attestorkey. - Tenant, project, environment, action, contract, resource, predicate, Probe ID, nonce, and validity window are bound before a target read.
- Nonces are persisted and replay returns HTTP 409.
- Request bodies and target reads are bounded by size and timeout.
- The Probe process receives a read credential only. The reference Compose service has no write-secret reference and joins only the read network.
- Raw target responses and credentials are excluded from evidence packets.
What separation means
Separate-process mode protects against accidental same-process coupling. Separate-container mode adds filesystem and network-policy boundaries. A customer-network deployment can place the Probe in a distinct account or segment. None of these alone proves organizational independence or external review.
Failure behavior
Expired, malformed, replayed, incorrectly scoped, revoked, or wrongly signed requests fail closed before target access. An unverified predicate produces a signed NOT_VERIFIED attestation; it never becomes a passing evidence packet.