# KOKON Controls Matrix · Wave 7 · X3 · 2026-07-13 This file lists the operational + technical controls in place on KOKON Control Company. Each row maps a control to the Wave 1-6 item that implements it and the runbook / code path an auditor can check. Regulator-facing surfaces: - Live status: `/ui/regulator` - Chain state: `GET /api/control/audit/gov-verify` - Evidence: `GET /api/control/audit/evidence-bundle?days=N` - SBOM: `GET /api/control/audit/sbom` ## 1 · Data availability | ID | Control | Implementation | Evidence | | ----- | ---------------------------------------------- | ------------------------------------------------------ | ----------------------------------------------------------- | | A-01 | Full-database backups run at least weekly | `scripts/backup-full-prod.sh` · cron 03:00 UTC Sundays | `docs/runbook/logs/2026-07-12-backup-restore-drill.md` | | A-02 | Restore path is rehearsed on a live drill | `scripts/restore-prod-from-backup.sh` · VERIFY_ONLY=1 | Same drill log · 815 k rows restored into temp DB | | A-03 | Systemd auto-restart on process crash | `Restart=always` in kokon-control-company.service | `docs/runbook/logs/2026-07-12-chaos-drill.md` (drill 2) | ## 2 · Observability | ID | Control | Implementation | Evidence | | ----- | ---------------------------------------------- | ------------------------------------------------------ | ----------------------------------------------------------- | | O-01 | Distributed traces across the brain client | `internal/observability/otel.go` · 4096-span ring | `GET /api/control/observability/traces?limit=100` | | O-02 | Rolling SLO per critical endpoint | `internal/observability/slo.go` · 500-sample window | `GET /api/control/observability/slo/status` | | O-03 | External-monitor liveness endpoint | `internal/observability/liveness.go` · MANDATORY/ADV | `GET /api/control/observability/liveness` | | O-04 | Passive ARIN health beacon (1 h ring) | `internal/observability/arin_beacon.go` | `GET /api/control/observability/arin-beacon` | | O-05 | Brain-freshness SLI (FRESH/AGING/STALE) | `internal/observability/brain_freshness.go` | `GET /api/control/observability/brain-freshness` | ## 3 · Change management | ID | Control | Implementation | Evidence | | ----- | ---------------------------------------------- | ------------------------------------------------------ | ----------------------------------------------------------- | | C-01 | Every commit passes CI (build + vet + race) | `.github/workflows/ci.yml` · `make ci-go` | GitHub Actions history on main branch | | C-02 | Byte-deterministic case-runner output | `internal/agentic/byte_determinism_test.go` | 13 doctrine cases × 10 iters (50 via env) · commit `bef158b`| | C-03 | Fuzz-guarded metric-key normaliser | `internal/observability/normalise_fuzz_test.go` | Wave 2 · T3 seeds pinned · commit `aa72210` | | C-04 | Nightly ARIN contract test detects drift ≤24h | `scripts/nightly-arin-contract.sh` · cron 03:15 UTC | `/var/log/kokon-arin-contract.log` + gov ledger row per run | ## 4 · Authentication + secrets | ID | Control | Implementation | Evidence | | ----- | ---------------------------------------------- | ------------------------------------------------------ | ----------------------------------------------------------- | | S-01 | Class A secret rotation procedure documented | `docs/runbook/secret-rotation.md` | `docs/runbook/logs/2026-07-12-arin-token-drill.md` | | S-02 | Ops writes to gov ledger via token bypass | `KOKON_GOV_LEDGER_TOKEN` env · `X-KOKON-OPS-TOKEN` hdr | Wave 4 · G2 · commit `a5aff10` | | S-03 | Evidence bundle signed with ed25519 | `internal/service/gov_evidence_signing.go` | `GET /ui/regulator` publishes the public key | ## 5 · Audit + tamper evidence | ID | Control | Implementation | Evidence | | ----- | ---------------------------------------------- | ------------------------------------------------------ | ----------------------------------------------------------- | | E-01 | Append-only ledger of privileged operations | `internal/service/gov_ledger.go` · `kokon_gov_ledger` | Wave 4 · G1 · commit `a5aff10` | | E-02 | Chain-verifier detects post-hoc tampering | `GET /api/control/audit/gov-verify` | Wave 4 · G3 · positive + tamper drill logs | | E-03 | Realized case outcomes recorded on-chain | `internal/service/case_outcomes.go` | `kokon_case_outcomes` + `CASE_OUTCOME_REALIZED` gov rows | | E-04 | Evidence bundle export is byte-deterministic | `internal/service/gov_evidence_bundle.go` | `GET /api/control/audit/evidence-bundle` | | E-05 | ed25519 signature over evidence bundle digest | `internal/service/gov_evidence_signing.go` | Wave 7 · X4 | ## 6 · Business continuity | ID | Control | Implementation | Evidence | | ----- | ---------------------------------------------- | ------------------------------------------------------ | ----------------------------------------------------------- | | B-01 | Chaos drill exercises three failure modes | Wave 1 · F6 | `docs/runbook/logs/2026-07-12-chaos-drill.md` | | B-02 | Recovery-time budget measured live | 3 drills · 2 s / 7 s / 0 s down | Same postmortem | ## Notes - Every runbook drill also writes a row to the gov ledger (Wave 4 · G2 integration). A regulator can spot-check a drill claim by opening `/api/control/audit/gov-ledger` and filtering on the corresponding `external_ref`. - Off-host backup replication + PITR are in the Wave 2 follow-up ledger; not present in this control set until they ship. - Secret rotation for `KOKON_GOV_LEDGER_TOKEN` follows the Class A pattern in `docs/runbook/secret-rotation.md`. - SBOM regeneration: `scripts/generate-sbom.sh` → `sbom.json`; run on every deploy. ## Contact - Ops channel: `#kokon-ops` (see internal directory) - On-call runbook: `docs/runbook/` - Regulator inquiries: as listed in `/ui/regulator`