[{"data":1,"prerenderedAt":753},["ShallowReactive",2],{"navigation_docs":3,"-platform-supply-chain-security":237,"-platform-supply-chain-security-surround":748},[4,142],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":36},"Kinotic Apps","i-lucide-rocket","\u002Fapps","01.apps",[10,14,18,37,58,91,102,122,127],{"title":11,"path":12,"stem":13},"Introduction","\u002Fapps\u002Fintroduction","01.apps\u002F01.introduction",{"title":15,"path":16,"stem":17},"Quick Start","\u002Fapps\u002Fquick-start","01.apps\u002F02.quick-start",{"title":19,"icon":20,"path":21,"stem":22,"children":23,"page":36},"Application Structure","i-lucide-folder-tree","\u002Fapps\u002Fapplication-structure","01.apps\u002F03.application-structure",[24,28,32],{"title":25,"path":26,"stem":27},"Overview","\u002Fapps\u002Fapplication-structure\u002Foverview","01.apps\u002F03.application-structure\u002F01.overview",{"title":29,"path":30,"stem":31},"Applications and Projects","\u002Fapps\u002Fapplication-structure\u002Fapplications-and-projects","01.apps\u002F03.application-structure\u002F02.applications-and-projects",{"title":33,"path":34,"stem":35},"Artifact Types","\u002Fapps\u002Fapplication-structure\u002Fartifact-types","01.apps\u002F03.application-structure\u002F03.artifact-types",false,{"title":38,"icon":39,"path":40,"stem":41,"children":42,"page":36},"Services","i-lucide-network","\u002Fapps\u002Fservices","01.apps\u002F04.services",[43,46,50,54],{"title":25,"path":44,"stem":45},"\u002Fapps\u002Fservices\u002Foverview","01.apps\u002F04.services\u002F01.overview",{"title":47,"path":48,"stem":49},"Publishing Services","\u002Fapps\u002Fservices\u002Fpublishing-services","01.apps\u002F04.services\u002F02.publishing-services",{"title":51,"path":52,"stem":53},"Service Proxies","\u002Fapps\u002Fservices\u002Fservice-proxies","01.apps\u002F04.services\u002F03.service-proxies",{"title":55,"path":56,"stem":57},"Streaming","\u002Fapps\u002Fservices\u002Fstreaming","01.apps\u002F04.services\u002F04.streaming",{"title":59,"icon":60,"path":61,"stem":62,"children":63,"page":36},"Persistence","i-lucide-database","\u002Fapps\u002Fpersistence","01.apps\u002F05.persistence",[64,67,71,75,79,83,87],{"title":25,"path":65,"stem":66},"\u002Fapps\u002Fpersistence\u002Foverview","01.apps\u002F05.persistence\u002F01.overview",{"title":68,"path":69,"stem":70},"Defining Entities","\u002Fapps\u002Fpersistence\u002Fdefining-entities","01.apps\u002F05.persistence\u002F02.defining-entities",{"title":72,"path":73,"stem":74},"Entity Decorators","\u002Fapps\u002Fpersistence\u002Fentity-decorators","01.apps\u002F05.persistence\u002F03.entity-decorators",{"title":76,"path":77,"stem":78},"CRUD Operations","\u002Fapps\u002Fpersistence\u002Fcrud-operations","01.apps\u002F05.persistence\u002F04.crud-operations",{"title":80,"path":81,"stem":82},"Named Queries","\u002Fapps\u002Fpersistence\u002Fnamed-queries","01.apps\u002F05.persistence\u002F05.named-queries",{"title":84,"path":85,"stem":86},"Multi-Tenancy","\u002Fapps\u002Fpersistence\u002Fmulti-tenancy","01.apps\u002F05.persistence\u002F06.multi-tenancy",{"title":88,"path":89,"stem":90},"Migrations","\u002Fapps\u002Fpersistence\u002Fmigrations","01.apps\u002F05.persistence\u002F07.migrations",{"title":92,"icon":93,"path":94,"stem":95,"children":96,"page":36},"Security","i-lucide-shield-check","\u002Fapps\u002Fsecurity","01.apps\u002F06.security",[97],{"title":98,"path":99,"stem":100,"icon":101},"Authentication","\u002Fapps\u002Fsecurity\u002Fauthentication","01.apps\u002F06.security\u002F01.authentication","i-lucide-key-round",{"title":103,"icon":104,"path":105,"stem":106,"children":107,"page":36},"Deployment","i-lucide-cloud-upload","\u002Fapps\u002Fdeployment","01.apps\u002F07.deployment",[108,113,118],{"title":109,"path":110,"stem":111,"icon":112},"Deployment Workflow","\u002Fapps\u002Fdeployment\u002Fworkflow","01.apps\u002F07.deployment\u002F01.workflow","i-lucide-git-branch",{"title":114,"path":115,"stem":116,"icon":117},"Environments","\u002Fapps\u002Fdeployment\u002Fenvironments","01.apps\u002F07.deployment\u002F02.environments","i-lucide-server",{"title":119,"path":120,"stem":121,"icon":6},"Push to Deploy","\u002Fapps\u002Fdeployment\u002Fpush-to-deploy","01.apps\u002F07.deployment\u002F03.push-to-deploy",{"title":123,"path":124,"stem":125,"icon":126},"CLI Reference","\u002Fapps\u002Fcli-reference","01.apps\u002F08.cli-reference","i-lucide-terminal",{"title":128,"icon":129,"path":130,"stem":131,"children":132,"page":36},"Reference","i-lucide-book-open","\u002Fapps\u002Freference","01.apps\u002F09.reference",[133,138],{"title":134,"path":135,"stem":136,"icon":137},"Decorators Reference","\u002Fapps\u002Freference\u002Fdecorators","01.apps\u002F09.reference\u002F01.decorators","i-lucide-at-sign",{"title":139,"path":140,"stem":141,"icon":60},"Migration SQL Grammar","\u002Fapps\u002Freference\u002Fmigration-sql-grammar","01.apps\u002F09.reference\u002F02.migration-sql-grammar",{"title":143,"icon":117,"path":144,"stem":145,"children":146,"page":36},"Kinotic OS","\u002Fplatform","02.platform",[147,152,156,161,166,171,175,180,185,190,195,200,222,227,232],{"title":148,"path":149,"stem":150,"icon":151},"System Architecture","\u002Fplatform\u002Farchitecture","02.platform\u002F01.architecture","i-lucide-boxes",{"title":153,"path":154,"stem":155,"icon":6},"Deployment Guide","\u002Fplatform\u002Fdeployment-guide","02.platform\u002F02.deployment-guide",{"title":157,"path":158,"stem":159,"icon":160},"Configuration","\u002Fplatform\u002Fconfiguration","02.platform\u002F03.configuration","i-lucide-settings",{"title":162,"path":163,"stem":164,"icon":165},"Organization Management","\u002Fplatform\u002Forganization-management","02.platform\u002F04.organization-management","i-lucide-building",{"title":167,"path":168,"stem":169,"icon":170},"System Security","\u002Fplatform\u002Fsystem-security","02.platform\u002F05.system-security","i-lucide-shield",{"title":172,"path":173,"stem":174,"icon":93},"Defense in Depth","\u002Fplatform\u002Fdefense-in-depth","02.platform\u002F06.defense-in-depth",{"title":176,"path":177,"stem":178,"icon":179},"MCP Tools","\u002Fplatform\u002Fmcp-tools","02.platform\u002F07.mcp-tools","i-lucide-bot",{"title":181,"path":182,"stem":183,"icon":184},"Observability","\u002Fplatform\u002Fobservability","02.platform\u002F08.observability","i-lucide-activity",{"title":186,"path":187,"stem":188,"icon":189},"Contributing","\u002Fplatform\u002Fcontributing","02.platform\u002F09.contributing","i-lucide-git-pull-request",{"title":191,"path":192,"stem":193,"icon":194},"System Migrations","\u002Fplatform\u002Fsystem-migrations","02.platform\u002F10.system-migrations","i-lucide-database-zap",{"title":196,"path":197,"stem":198,"icon":199},"Service Call Liveness","\u002Fplatform\u002Fservice-call-liveness","02.platform\u002F11.service-call-liveness","i-lucide-heart-pulse",{"title":128,"icon":129,"path":201,"stem":202,"children":203,"page":36},"\u002Fplatform\u002Freference","02.platform\u002F12.reference",[204,209,214,218],{"title":205,"path":206,"stem":207,"icon":208},"CRI Format","\u002Fplatform\u002Freference\u002Fcri-format","02.platform\u002F12.reference\u002F01.cri-format","i-lucide-link",{"title":210,"path":211,"stem":212,"icon":213},"Grind Jobs","\u002Fplatform\u002Freference\u002Fgrind-jobs","02.platform\u002F12.reference\u002F02.grind-jobs","i-lucide-workflow",{"title":215,"path":216,"stem":217,"icon":151},"Project Publishing Design","\u002Fplatform\u002Freference\u002Fproject-publishing-design","02.platform\u002F12.reference\u002F03.project-publishing-design",{"title":219,"path":220,"stem":221,"icon":101},"Sign-In Design","\u002Fplatform\u002Freference\u002Fsign-in-design","02.platform\u002F12.reference\u002F04.sign-in-design",{"title":223,"path":224,"stem":225,"icon":226},"Development Server","\u002Fplatform\u002Fdevelopment-server","02.platform\u002F13.development-server","i-lucide-server-cog",{"title":228,"path":229,"stem":230,"icon":231},"Supply Chain Security","\u002Fplatform\u002Fsupply-chain-security","02.platform\u002F14.supply-chain-security","i-lucide-package-check",{"title":233,"path":234,"stem":235,"icon":236},"Enterprise License","\u002Fplatform\u002Fenterprise-license","02.platform\u002F15.enterprise-license","i-lucide-badge-check",{"id":238,"title":228,"body":239,"description":741,"extension":742,"links":743,"meta":744,"navigation":745,"path":229,"seo":746,"stem":230,"__hash__":747},"docs\u002F02.platform\u002F14.supply-chain-security.md",{"type":240,"value":241,"toc":725},"minimark",[242,246,259,264,324,328,332,426,430,487,491,551,555,590,594,640,644],[243,244,25],"h2",{"id":245},"overview",[247,248,249,250,254,255,258],"p",{},"Every Kinotic service image is inventoried and scanned for known vulnerabilities before it is published. An image with a Critical vulnerability that has a published fix is never promoted to Docker Hub. Every control on this page runs automatically in the ",[251,252,253],"code",{},"Build and Publish"," workflow (",[251,256,257],{},".github\u002Fworkflows\u002Fgradle-build.yml","), and each one leaves evidence in GitHub.",[260,261,263],"h3",{"id":262},"scope","Scope",[265,266,267,280],"table",{},[268,269,270],"thead",{},[271,272,273,277],"tr",{},[274,275,276],"th",{},"Image",[274,278,279],{},"Published as",[281,282,283,294,304,314],"tbody",{},[271,284,285,289],{},[286,287,288],"td",{},"Kinotic management server",[286,290,291],{},[251,292,293],{},"kinoticai\u002Fkinotic-server-management",[271,295,296,299],{},[286,297,298],{},"Kinotic system server",[286,300,301],{},[251,302,303],{},"kinoticai\u002Fkinotic-server-system",[271,305,306,309],{},[286,307,308],{},"Kinotic app server",[286,310,311],{},[251,312,313],{},"kinoticai\u002Fkinotic-server-app",[271,315,316,319],{},[286,317,318],{},"Kinotic migration",[286,320,321],{},[251,322,323],{},"kinoticai\u002Fkinotic-migration",[243,325,327],{"id":326},"controls","Controls",[260,329,331],{"id":330},"software-inventory-sbom","Software inventory (SBOM)",[265,333,334,342],{},[268,335,336],{},[271,337,338,340],{},[274,339],{},[274,341],{},[281,343,344,355,373,391,416],{},[271,345,346,352],{},[286,347,348],{},[349,350,351],"strong",{},"Control",[286,353,354],{},"Each build produces a software bill of materials for each image. It lists every operating-system package and application library in the image, with its version.",[271,356,357,362],{},[286,358,359],{},[349,360,361],{},"Format",[286,363,364,365,372],{},"CycloneDX JSON, generated with ",[366,367,371],"a",{"href":368,"rel":369},"https:\u002F\u002Fgithub.com\u002Fanchore\u002Fsyft",[370],"nofollow","Syft"," from the built image, not from source manifests. The inventory therefore matches what runs.",[271,374,375,380],{},[286,376,377],{},[349,378,379],{},"Frequency",[286,381,382,383,386,387,390],{},"Every build of the images: each pull request into ",[251,384,385],{},"develop"," or ",[251,388,389],{},"main",", each push to them that changes application code, and nightly.",[271,392,393,398],{},[286,394,395],{},[349,396,397],{},"Evidence",[286,399,400,401,404,405,404,408,411,412,415],{},"Workflow run artifacts named ",[251,402,403],{},"sbom-kinotic-server-management.cdx.json",", ",[251,406,407],{},"sbom-kinotic-server-system.cdx.json",[251,409,410],{},"sbom-kinotic-server-app.cdx.json"," and ",[251,413,414],{},"sbom-kinotic-migration.cdx.json",".",[271,417,418,423],{},[286,419,420],{},[349,421,422],{},"Retention",[286,424,425],{},"90 days.",[260,427,429],{"id":428},"vulnerability-scanning","Vulnerability scanning",[265,431,432,440],{},[268,433,434],{},[271,435,436,438],{},[274,437],{},[274,439],{},[281,441,442,456,465],{},[271,443,444,448],{},[286,445,446],{},[349,447,351],{},[286,449,450,455],{},[366,451,454],{"href":452,"rel":453},"https:\u002F\u002Fgithub.com\u002Fanchore\u002Fgrype",[370],"Grype"," scans each image's SBOM against current vulnerability advisories: GitHub Security Advisories, the National Vulnerability Database, and operating-system vendor feeds. The scan covers the same artifact the inventory records.",[271,457,458,462],{},[286,459,460],{},[349,461,379],{},[286,463,464],{},"Every build, including each pull request, and nightly. The nightly run checks newly published advisories against the current images.",[271,466,467,471],{},[286,468,469],{},[349,470,397],{},[286,472,473,474,404,477,404,480,411,483,486],{},"Findings of every severity are recorded as GitHub code scanning alerts in the categories ",[251,475,476],{},"image-kinotic-server-management",[251,478,479],{},"image-kinotic-server-system",[251,481,482],{},"image-kinotic-server-app",[251,484,485],{},"image-kinotic-migration",", with open and fixed history per finding. Each workflow run's summary lists the fixable findings for each image.",[260,488,490],{"id":489},"release-gate","Release gate",[265,492,493,501],{},[268,494,495],{},[271,496,497,499],{},[274,498],{},[274,500],{},[281,502,503,521,531],{},[271,504,505,509],{},[286,506,507],{},[349,508,351],{},[286,510,511,512,515,516,386,518,520],{},"A build fails when either image has a ",[349,513,514],{},"Critical"," vulnerability with a published fix. On a pull request, the failure is reported on the change before it merges. Only an image from a fully passing build of ",[251,517,385],{},[251,519,389],{}," is promoted from the staging registry (ghcr.io) to Docker Hub.",[271,522,523,528],{},[286,524,525],{},[349,526,527],{},"Effect",[286,529,530],{},"An image is published only when, at build time, it has no known Critical vulnerability with an available fix.",[271,532,533,537],{},[286,534,535],{},[349,536,397],{},[286,538,539,540,543,544,547,548,550],{},"The ",[251,541,542],{},"SBOM and Vulnerability Scan"," jobs and the ",[251,545,546],{},"Build Result"," job of each workflow run. ",[251,549,546],{}," performs the promotion and records which job withheld it.",[260,552,554],{"id":553},"integrity-of-the-scanning-tools","Integrity of the scanning tools",[265,556,557,565],{},[268,558,559],{},[271,560,561,563],{},[274,562],{},[274,564],{},[281,566,567,576],{},[271,568,569,573],{},[286,570,571],{},[349,572,351],{},[286,574,575],{},"Third-party actions in the scan job are pinned to full commit SHAs rather than version tags, so a repointed tag cannot change the code that runs. The scan job has read-only access to repository contents and holds no publishing, signing or deployment credentials.",[271,577,578,583],{},[286,579,580],{},[349,581,582],{},"Maintenance",[286,584,585,586,589],{},"Dependabot proposes updates to every workflow action weekly, including the pinned SHAs (",[251,587,588],{},".github\u002Fdependabot.yml",").",[260,591,593],{"id":592},"source-code-analysis","Source code analysis",[265,595,596,604],{},[268,597,598],{},[271,599,600,602],{},[274,601],{},[274,603],{},[281,605,606,615,627],{},[271,607,608,612],{},[286,609,610],{},[349,611,351],{},[286,613,614],{},"CodeQL static analysis of the Java and TypeScript source.",[271,616,617,621],{},[286,618,619],{},[349,620,379],{},[286,622,623,624,626],{},"Every push to ",[251,625,385],{},", and weekly.",[271,628,629,633],{},[286,630,631],{},[349,632,397],{},[286,634,635,636,639],{},"GitHub code scanning alerts from the ",[251,637,638],{},"CodeQL"," workflow.",[243,641,643],{"id":642},"control-mapping","Control mapping",[265,645,646,661],{},[268,647,648],{},[271,649,650,652,655,658],{},[274,651,351],{},[274,653,654],{},"NIST SP 800-171 Rev 2",[274,656,657],{},"SOC 2",[274,659,660],{},"ISO\u002FIEC 27001:2022",[281,662,663,676,688,701,714],{},[271,664,665,667,670,673],{},[286,666,331],{},[286,668,669],{},"3.4.1",[286,671,672],{},"CC7.1",[286,674,675],{},"A.5.9, A.8.9",[271,677,678,680,683,685],{},[286,679,429],{},[286,681,682],{},"3.11.2",[286,684,672],{},[286,686,687],{},"A.8.8",[271,689,690,692,695,698],{},[286,691,490],{},[286,693,694],{},"3.11.3, 3.14.1",[286,696,697],{},"CC7.1, CC8.1",[286,699,700],{},"A.8.8, A.8.32",[271,702,703,705,708,711],{},[286,704,554],{},[286,706,707],{},"3.4.1, 3.14.1",[286,709,710],{},"CC8.1",[286,712,713],{},"A.8.25, A.8.28",[271,715,716,718,720,722],{},[286,717,593],{},[286,719,682],{},[286,721,672],{},[286,723,724],{},"A.8.28",{"title":726,"searchDepth":727,"depth":727,"links":728},"",2,[729,733,740],{"id":245,"depth":727,"text":25,"children":730},[731],{"id":262,"depth":732,"text":263},3,{"id":326,"depth":727,"text":327,"children":734},[735,736,737,738,739],{"id":330,"depth":732,"text":331},{"id":428,"depth":732,"text":429},{"id":489,"depth":732,"text":490},{"id":553,"depth":732,"text":554},{"id":592,"depth":732,"text":593},{"id":642,"depth":727,"text":643},"How Kinotic inventories, scans and gates the container images it publishes, and where the evidence for each control is kept.","md",null,{},{"icon":231},{"title":228,"description":741},"3FixwyRonm5i0gKGY2XUeOsvjLbuw9386XMdooPBBwM",[749,751],{"title":223,"path":224,"stem":225,"description":750,"icon":226,"children":-1},"A development environment for a few peers on one physical host, what it keeps in Azure, and how their applications move to Kinotic Cloud.",{"title":233,"path":234,"stem":235,"description":752,"icon":236,"children":-1},"Which parts of Kinotic are Enterprise Features, what running them in production requires, and how the license treats substitute implementations.",1792555581707]