Security review

Convert trust controls into customer-ready evidence.

Review pilot-critical controls and the next hardening step needed before handling production workloads.

watch

Owner: Security

Evidence: /customers/keys and /api/customer-api-keys/list

Add request signing, hard quotas, and per-customer rate limits.

ready

Owner: Infrastructure

Evidence: /nodes/keys, SHA-256 node-key hashing, telemetry validation

Add signed agent releases and telemetry replay protection.

watch

Owner: Compliance

Evidence: /routing, /regions, /compliance/evidence

Export route decision evidence bundle per customer and region.

ready

Owner: Platform

Evidence: /admin/audit and audit_events schema

Add immutable append-only mode and export signatures.