Watch — stage seven of the custody spine
Approved is not the same as running
The Estate matrix crosses every service with every environment: which digest is deployed, and what evidence stands behind it. After deploy, Watch keeps comparing the running digest against the approved digest — and the matrix changes when they differ.
Not a scheduled rescan. Watch runs for as long as the workload does.
The custody spine
- Source
- Build
- Scan
- Verdict
- Decision
- Deploy
- Watch
Each stage carries one of three states: MISSING, RECORDED, or SIGNED. The first six stages complete. Watch does not — it keeps checking that the record still matches reality.
One matrix, every environment
The estate below: services down the side, environments across the top, and the deviations panel open underneath. An unproven cell has its deployment recorded and its evidence unverified. A deviation is one agent's report of one running container whose digest is not an approved one; tampered findings carry their own count. Digest-firstRelease identity based on immutable content hashes (SHA-256 digests) rather than mutable tags — ensuring byte-identical deployments
Four terms the screen uses
Everything on the Estate screen reduces to what is deployed, what is proven, and what changed since approval.
Unproven cell
A deployment is recorded, but the evidence behind it is incomplete. The cell does not turn green on good faith.
Drift
Observing agents compare the digest each workload is actually running against the digest approved for that environment. A mismatch becomes a drift row: which service, which environment, which two digests disagree.
Tampered
An integrity violation: the running image has been altered relative to its signed record. Tampered findings are counted separately from drift, because an altered image is a different problem than an unapproved one.
Service passport
Every service carries its evidence trail: the state of each custody stage, from source to the latest Watch observation. When a cell needs explaining, the passport is what you open.
Why this is hard outside Kubernetes
Kubernetes clusters have an admission layer: a workload can be refused at the moment it is scheduled. Compose projects, SSH/WinRM hosts tasks jobs have no equivalent gate. Scanners stop at findings. CD tools stop at the deploy event. Admission controllers verify only inside Kubernetes, and leave no replayable decision evidence either way. So in most non-Kubernetes estates, nothing checks that what is running today is still what was approved. Watch covers that gap: continuous digest comparison for estates with no admission layer, with a record of every check.
How it works operationally
Agentless deploy targets
Stella Ops promotes releases to Docker Compose, SSH/WinRM hosts over each target's own interface. Deploying installs nothing on the target.
Observing agents
Watching is separate. Lightweight observers report the digests actually running on each target. Where no observer runs, runtime state is Missing — never assumed good.
What a drift row lets you do
- Trace the passport: which digest was approved for this environment, on what evidence, by whom.
- Re-verify: run verification again against current evidence and record the outcome.
- Roll back: redeploy the last known-good digest — an exact artifact, not a tag.
Who reads this screen
Release Ops Steward
What is live where?
One matrix answers it: every service, every environment, deployed digest, evidence posture. No cross-referencing deploy logs against registries.
Assurance Viewer
Is the right software deployed — and is that state compliant?
Read-only posture per cell: what is running, whether its evidence chain is complete, and when it was last checked.
Security Risk Manager
Is anything running that we did not approve?
Unapproved or altered images surface as drift and tampered rows, with the approved digest to compare against. A standing check, not a periodic report.
Estate evidence feeds compliance packs
The custody records and Watch observations collected here are the raw material compliance packs draw on. Enabling starts evidence collection in conservative evidence-only mode; it does not claim regulatory compliance.