ADR-042 demo set
Demonstrations
The 10 scenarios we show live. Each card shows what it proves, how it is run, its current status from the latest lab run, and the raw evidence.
Zero-trust port admission
How it's run: A clean device on an access port: EAP-TLS with TPM cert → hostapd → controller moves the port from quarantine to its VLAN
Evidence from the latest run
T1 · passed · run 14 Oct 2026, 17:34 CEST
EAP SUCCESS, port Vlan70, gateway reach, audit: {"seq":3,"ts":"2026-10-14T15:34:14.378283053Z","site":"edge-a","src":"gatectl","event":"ADMIT","port":"Ethernet8","mac": (software device key; TPM-backed key in phase 3)
Per-customer trust domains
How it's run: A device registered to customer A, plugged into Edge B, stays in quarantine
Evidence from the latest run
Boot tamper detection
How it's run: A Talos node with a modified boot image (UKI) can't unlock its disk and never joins
No lab run recorded yet. Status from the test list: blocked 2026-10-14: needs our own Secure Boot keys (ADR-028) to boot a modified UKI against; planned phase 3
Cross-domain authorization
How it's run: A workload in Edge A calls Core and succeeds; a call from A to B is rejected
Evidence from the latest run
T10 · passed (identity layer) · run 14 Oct 2026, 17:34 CEST
Edge A SVID (URI:spiffe://edge-customer-a.bastion/workload/sensor, ttl 599s) verifies at Core with the federated edge-customer-a bundle; Core holds no edge-customer-b bundle ('Error: rpc error: code = NotFound desc = bundle not found') so B identities are rejected; workload mTLS call follows with Argo CD-deployed apps (phase 3)
Two-egress rule
How it's run: Only NATS (7222) and the Argo CD path leave an edge; any other outbound attempt is blocked and logged
Evidence from the latest run
T11 · passed (lab border) · run 14 Oct 2026, 17:34 CEST
Edge A pod -> Core: 443 open, 7222 open, 6443 blocked, 4222 blocked, 50000 blocked; switch -> Core 4222 blocked; Core -> Edge 6443 blocked; 23 packets dropped+logged. Enforced by the lab-VM border chain standing in for the SONiC border ACL (ADR-047)
Disconnected operation
How it's run: The WAN is cut: the edge keeps running, NATS buffers, then the edge reconciles when the link returns
Evidence from the latest runs
T12 · passed · run 14 Oct 2026, 17:34 CEST
WAN cut: Edge A node Ready, 5 readings buffered locally (edge stream=5), Core count 0 during cut; after reconnect Core=5 (replayed). Argo CD resync part follows in phase 3
T12b · passed · run 14 Oct 2026, 18:48 CEST
Argo CD at Edge A: during WAN cut app kept running (ready=1, sync=Synced, Git change not reachable); after reconnect it reconciled to Git rev 6239b93d (ready=2) by pull only
Secure offline updates
How it's run: Air-gapped update: a signed and encrypted volume on the update port goes through the quarantine VM, signature check, TPM decrypt, local registry and Argo CD
No lab run recorded yet. Status from the test list: blocked 2026-10-14: air-gap path is phase 4
Update integrity
How it's run: A tampered or unsigned update volume is rejected in quarantine
No lab run recorded yet. Status from the test list: blocked 2026-10-14: air-gap path is phase 4
No chicken-and-egg deadlock
How it's run: Cold-start bootstrap: power on an empty Edge; it comes up in ADR-016 order with no Core connection
Evidence from the latest run
T21 · passed (partial) · run 14 Oct 2026, 18:48 CEST
WAN cut, KMS restarted, Edge Talos rebooted: 1 local KMS release(s), node Ready, demo app ready=2 from local Argo CD/K8s state with Core unreachable. Switch host was not power-cycled (gate state would need re-provisioning, T62) and FDO/Keylime steps are not built
Edge revocation (ADR-032)
How it's run: Run the revocation runbook for an Edge: federation, NATS and key release are all cut in one action, and it appears in the audit log
Evidence from the latest run
T40 · passed · run 14 Oct 2026, 17:34 CEST
after one revoke action: Core edge-a bundle certs=0, leaf messages reaching Core=0 (leaf log auth errors: 14), KMS key release stopped for node 135eb9a2-825e-4f3c-beca-d66921734a87 (revoked list entry=1; denial-on-reboot proven in T7), audit entries total=3; restore brought traffic back (1) and re-enabled release