{
"schema_version": "telosieve.adversarial-coverage/v1",
"authority_boundary": "read-only-no-target-mutation",
"modes": [
"kubernetes-shadow",
"kubernetes-live",
"opentofu-plan",
"external-read-only"
],
"limits": {
"maximum_threat_classes": 64,
"maximum_evidence_per_cell": 4,
"maximum_registry_bytes": 262144
},
"threat_classes": [
{
"id": "authority-evidence-substitution",
"title": "Authority or target evidence is omitted, forged, or substituted",
"priority": "required",
"applicable_modes": ["kubernetes-shadow", "kubernetes-live", "opentofu-plan", "external-read-only"],
"coverage": {
"kubernetes-shadow": {"status": "covered", "evidence": [{"path": "tests/adversarial.rs", "anchor": "registered_adversarial_fault_classes_fail_closed_or_refuse"}]},
"kubernetes-live": {"status": "covered", "evidence": [{"path": "scripts/run-kubernetes-real-cluster.py", "anchor": "authority mismatch did not fail closed"}]},
"opentofu-plan": {"status": "covered", "evidence": [{"path": "src/opentofu_plan.rs", "anchor": "unsupported_sensitive_unknown_duplicate_and_mismatched_plans_fail_closed"}]},
"external-read-only": {"status": "covered", "evidence": [{"path": "tests/integration_contract.rs", "anchor": "authority"}]}
}
},
{
"id": "malformed-ambiguous-or-oversized-input",
"title": "Malformed, ambiguous, unknown, or resource-exhausting input crosses the parser boundary",
"priority": "required",
"applicable_modes": ["kubernetes-shadow", "kubernetes-live", "opentofu-plan", "external-read-only"],
"coverage": {
"kubernetes-shadow": {"status": "covered", "evidence": [{"path": "tests/evaluation_cli.rs", "anchor": "versioned_evaluation_cli_is_read_only_bounded_and_fail_closed"}]},
"kubernetes-live": {"status": "covered", "evidence": [{"path": "tests/kubernetes_live_cli.rs", "anchor": "oversized"}]},
"opentofu-plan": {"status": "covered", "evidence": [{"path": "src/opentofu_plan.rs", "anchor": "MAX_RESOURCE_CHANGES"}]},
"external-read-only": {"status": "covered", "evidence": [{"path": "src/integration.rs", "anchor": "MAX_RESPONSE_BYTES"}, {"path": "scripts/test-redis-integration.py", "anchor": "test_resp_types_and_bounds"}, {"path": "scripts/test-postgresql-integration.py", "anchor": "test_credentials_and_psql_output_fail_closed"}, {"path": "scripts/test-http-json-integration.py", "anchor": "test_snapshot_shapes_and_bounds_fail_closed"}]}
}
},
{
"id": "mutation-attempt",
"title": "An input, credential, or requested operation attempts target mutation",
"priority": "required",
"applicable_modes": ["kubernetes-shadow", "kubernetes-live", "opentofu-plan", "external-read-only"],
"coverage": {
"kubernetes-shadow": {"status": "covered", "evidence": [{"path": "tests/evaluation_cli.rs", "anchor": "mutation-mode.json"}]},
"kubernetes-live": {"status": "covered", "evidence": [{"path": "scripts/run-kubernetes-real-cluster.py", "anchor": "(\"patch\", \"configmap/repair-goal\")"}]},
"opentofu-plan": {"status": "covered", "evidence": [{"path": "scripts/run-opentofu-plan.py", "anchor": "destructive plan emitted evidence"}]},
"external-read-only": {"status": "covered", "evidence": [{"path": "tests/integration_contract.rs", "anchor": "mutation-capability"}, {"path": "scripts/run-redis-integration.py", "anchor": "unexpectedly has mutation authority"}, {"path": "scripts/run-postgresql-integration.py", "anchor": "SELECT * FROM secret_state.must_not_read"}, {"path": "scripts/run-http-json-integration.py", "anchor": "mutation method was not denied"}]}
}
},
{
"id": "incoherent-or-racing-observation",
"title": "The observed target changes or becomes incoherent during collection",
"priority": "required",
"applicable_modes": ["kubernetes-shadow", "kubernetes-live", "external-read-only"],
"coverage": {
"kubernetes-shadow": {"status": "covered", "evidence": [{"path": "src/kubernetes_shadow.rs", "anchor": "drift_partial_stale_identity_schema_and_authority_mismatch_fail_closed"}]},
"kubernetes-live": {"status": "covered", "evidence": [{"path": "tests/kubernetes_live_cli.rs", "anchor": "fails_closed_on_drift"}]},
"opentofu-plan": {"status": "not-applicable", "reason": "The adapter consumes one immutable saved-plan byte sequence and binds its exact digest."},
"external-read-only": {"status": "covered", "evidence": [{"path": "tests/integration_contract.rs", "anchor": "incomplete"}, {"path": "scripts/run-postgresql-integration.py", "anchor": "for index in range(4)"}, {"path": "scripts/run-http-json-integration.py", "anchor": "producer-disagreement"}]}
}
},
{
"id": "credential-scope-abuse",
"title": "Evaluation credentials are used beyond the minimum read-only scope",
"priority": "required",
"applicable_modes": ["kubernetes-live", "external-read-only"],
"coverage": {
"kubernetes-shadow": {"status": "not-applicable", "reason": "The shadow adapter has no target credentials or live client."},
"kubernetes-live": {"status": "covered", "evidence": [{"path": "scripts/run-kubernetes-real-cluster.py", "anchor": "must-not-read"}, {"path": "deploy/kubernetes/evaluation-rbac.yaml", "anchor": "resources: [\"configmaps\"]"}]},
"opentofu-plan": {"status": "not-applicable", "reason": "The saved-plan adapter has no provider, backend, or cloud credential interface."},
"external-read-only": {"status": "covered", "evidence": [{"path": "scripts/run-redis-integration.py", "anchor": "mutation_attempts_refused"}, {"path": "scripts/run-postgresql-integration.py", "anchor": "forbidden_operations_refused"}, {"path": "scripts/test-http-json-integration.py", "anchor": "test_credentials_fail_closed"}]}
}
},
{
"id": "transport-timeout-or-outage",
"title": "A live target transport stalls, fails, or disappears",
"priority": "required",
"applicable_modes": ["kubernetes-live", "external-read-only"],
"coverage": {
"kubernetes-shadow": {"status": "not-applicable", "reason": "The shadow adapter consumes a bounded local export without network transport."},
"kubernetes-live": {"status": "covered", "evidence": [{"path": "tests/kubernetes_live_cli.rs", "anchor": "timeout"}, {"path": "scripts/run-kubernetes-real-cluster.py", "anchor": "API outage did not fail closed"}]},
"opentofu-plan": {"status": "not-applicable", "reason": "The saved-plan adapter consumes a bounded local file without network transport."},
"external-read-only": {"status": "covered", "evidence": [{"path": "tests/integration_contract.rs", "anchor": "timed_out_adapter"}, {"path": "scripts/run-redis-integration.py", "anchor": "outage-evaluation.json"}, {"path": "scripts/run-postgresql-integration.py", "anchor": "fault(\"lock-timeout\""}, {"path": "scripts/run-http-json-integration.py", "anchor": "(\"timeout\",\"timeout\")"}]}
}
},
{
"id": "output-alias-or-partial-evidence",
"title": "Evidence output aliases trusted input or persistence fails partway",
"priority": "required",
"applicable_modes": ["kubernetes-shadow", "kubernetes-live", "opentofu-plan", "external-read-only"],
"coverage": {
"kubernetes-shadow": {"status": "covered", "evidence": [{"path": "tests/evaluation_cli.rs", "anchor": "temporary_collision_config"}]},
"kubernetes-live": {"status": "covered", "evidence": [{"path": "src/evaluation.rs", "anchor": "reject_live_path_collisions"}]},
"opentofu-plan": {"status": "covered", "evidence": [{"path": "src/engine.rs", "anchor": "OpenTofuError::OutputCollision"}]},
"external-read-only": {"status": "covered", "evidence": [{"path": "tests/integration_contract.rs", "anchor": "alias_refused"}]}
}
},
{
"id": "replay-rollback-or-equivocation",
"title": "Previously valid, rolled-back, or conflicting authority evidence is replayed",
"priority": "required",
"applicable_modes": ["kubernetes-shadow", "kubernetes-live", "opentofu-plan", "external-read-only"],
"coverage": {
"kubernetes-shadow": {"status": "covered", "evidence": [{"path": "tests/adversarial.rs", "anchor": "equivocation"}]},
"kubernetes-live": {"status": "covered", "evidence": [{"path": "tests/adversarial.rs", "anchor": "stale"}]},
"opentofu-plan": {"status": "covered", "evidence": [{"path": "tests/adversarial.rs", "anchor": "replayed"}]},
"external-read-only": {"status": "covered", "evidence": [{"path": "src/integration.rs", "anchor": "captured_at != scenario.evaluation_time"}]}
}
},
{
"id": "compromised-consistent-producer",
"title": "A compromised producer supplies internally consistent but false observations",
"priority": "research-gap",
"applicable_modes": ["kubernetes-shadow", "kubernetes-live", "opentofu-plan", "external-read-only"],
"coverage": {
"kubernetes-shadow": {"status": "covered", "evidence": [{"path": "tests/evaluation_cli.rs", "anchor": "forged_quorum"}]},
"kubernetes-live": {"status": "deferred", "reason": "Separate signed producer processes now detect local collector faults, but all qualified producers still trust one project-controlled Kubernetes API server."},
"opentofu-plan": {"status": "deferred", "reason": "Requires independent provider and state truth; plan JSON alone can lie consistently."},
"external-read-only": {"status": "deferred", "reason": "Exact-byte quorum detects disagreement but cannot prove independently administered adapters or truthful platform observations."}
}
},
{
"id": "sustained-adversarial-load",
"title": "Repeated hostile evaluations exhaust CPU, memory, process, or target request budgets",
"priority": "required",
"applicable_modes": ["kubernetes-shadow", "kubernetes-live", "opentofu-plan", "external-read-only"],
"coverage": {
"kubernetes-shadow": {"status": "covered", "evidence": [{"path": "scripts/run-sustained-adversarial-load.py", "anchor": "SHADOW_ATTACK_BYTES = 1024 * 1024 + 1"}]},
"kubernetes-live": {"status": "covered", "evidence": [{"path": "scripts/run-sustained-adversarial-load.py", "anchor": "LIVE_RESPONSE_ATTACK_BYTES = 1024 * 1024 + 1"}, {"path": "scripts/run-kubernetes-real-cluster.py", "anchor": "LOAD_EVALUATIONS = 8"}]},
"opentofu-plan": {"status": "covered", "evidence": [{"path": "scripts/run-sustained-adversarial-load.py", "anchor": "OPENTOFU_ATTACK_BYTES = 2 * 1024 * 1024 + 1"}]},
"external-read-only": {"status": "covered", "evidence": [{"path": "tests/integration_contract.rs", "anchor": "for _ in 0..4"}, {"path": "scripts/run-redis-integration.py", "anchor": "LOAD_EVALUATIONS = 8"}, {"path": "scripts/run-postgresql-integration.py", "anchor": "LOAD_EVALUATIONS, LOAD_CONCURRENCY = 8, 4"}, {"path": "scripts/run-http-json-integration.py", "anchor": "LOAD_EVALUATIONS, LOAD_CONCURRENCY = 8, 4"}]}
}
}
]
}