The image is attested.
Will the cluster enforce it?
Map sanitized namespace-policy aliases before admission enforcement. Connect pushed provenance, trust root, include and exemption matching, namespace state, allow/deny fixtures and tested rollback—without pasting an image, digest, cluster, YAML or credential.
Attestation admission rollout map
| Policy alias | Artifact / trust root | Image match / exemption | Namespace / enforcement | Allow / deny / rollback | Evidence / owner | Decision / result |
|---|
Policy, test and rollback queue
“Evidence recorded” proves only coherent abstract metadata. This page did not verify an attestation, inspect image patterns, connect to Kubernetes, evaluate a policy, run admission, generate YAML, change a namespace, deploy, certify security or guarantee availability.
Zero-cluster boundary: all free analysis stays in this browser. Enter only fictional aliases, enumerated states and safe evidence references. Never paste a real organization, registry/image, tag/digest, namespace, cluster, policy YAML/JSON, Helm values, kubeconfig, endpoint, token, certificate, credential or private log. This page does not verify provenance, calculate image matching, connect to GitHub/Sigstore/Kubernetes, generate deployable policy, label a namespace, enforce admission or certify supply-chain security. Authorized security, Kubernetes and platform owners control every real policy, test, rollback and deployment.
$18 Attestation Admission Rollout Evidence Pack
Export an editable matrix for up to 100 sanitized policy records: provenance prerequisites, trust root, include/exempt conflicts, namespace rollout, allow/deny tests, rollback, sign-off and PMF ledger.
- up to 100 sanitized policy records
- provenance and GitHub TrustRoot prerequisite matrix
- image include/exempt conflict and exception queue
- namespace enforcement plus allow/deny fixtures
- rollback, source-date and human sign-off
- 45-day qualified-visit, use, intent and paid ledger
Current GitHub attestation enforcement and security limits
PMF pre-judgment 87/100 · $18 one-time evidence pack under strong Sigstore, GitOps and admission-policy substitutes