Promotion Rekor Tile Verification (Air-Gap)
Audience: release operators running promotion gates inside a sealed enclave.
Purpose
Operational runbook for using Rekor transparency-log tile material in air-gapped promotion gates, so a promotion can be evaluated against verifiable inclusion proofs without reaching a live Rekor instance.
Preconditions
- Offline bundle includes tile/proof artifacts and trust roots.
- Promotion gate is configured to consume offline proof references.
- Operator has tenant-scoped Authority credentials.
Inputs
- Promotion identifier
- Evidence bundle identifier
- Rekor tile/proof bundle from offline sync
- Trust root set (Fulcio/KMS roots and Rekor checkpoint material)
Procedure
- Validate bundle integrity.
- Import tile/proof files into the local Attestor cache.
- Run offline verification for referenced DSSE envelopes.
- Attach verification outputs to promotion gate input payload.
- Execute promotion gate evaluation.
- Persist decision record with proof references.
Example Commands
# 1) verify portable evidence bundle
stella evidence verify --bundle portable-evidence-bundle.tgz --offline
# 2) import tile material
stella rekor tiles import --bundle rekor-tiles.tgz
# 3) verify inclusion proofs offline
stella rekor verify --offline --evidence-bundle-id <bundle-id>
# 4) run promotion gate preview with offline verification enabled
stella promotion preview-gates --promotion <promotion-id> --offline-rekor
Failure Modes
| Failure mode | Expected gate behavior | Operator action |
|---|---|---|
| Missing tile/proof files | Fail closed (deny or pending per policy) | Re-sync offline bundle and retry verification |
| Invalid proof chain | Fail closed | Rotate trust roots or investigate tampering |
| Expired trust roots | Fail closed | Import updated trust bundle from connected zone |
| Break-glass enabled | Explicitly auditable non-standard path | Record reason/ticket and time-bound override |
Offline QA Matrix (Deterministic)
- Valid tile/proof bundle produces identical verification output hash across repeated runs.
- Missing tile segment fails closed with stable reason code.
- Tampered inclusion proof fails closed with stable reason code.
- Expired trust root fails closed with stable reason code.
- Break-glass path emits explicit marker and does not masquerade as standard verification.
Audit Outputs
- Promotion decision record id
- Policy decision digest
- Evidence bundle id
- Rekor verification report reference
- Break-glass marker (if used)