templates

var PostureChecklist = []PostureItem{
	{"No shell command strings", "Every Docker operation is a typed call to the Engine API; there is no os/exec anywhere in the control plane.", "TestNoShellExecFromUserInput"},
	{"No raw Docker socket", "Only the socket-proxy holds docker.sock; every call passes an endpoint allow-list that denies exec, privileged and host-affecting endpoints.", "TestNoContainerGetsTheDockerSocket, TestSocketProxyDeniesExec"},
	{"Hardened app containers", "Non-root, no-new-privileges, cap_drop ALL, read-only rootfs with noexec/nosuid tmpfs, seccomp + AppArmor, memory/CPU/pids limits, per-app network.", "TestHardenedHostConfig, TestIntegrationPhase1AllAppContainersHardened"},
	{"Overrides are loud", "Relaxing a default needs an explicit flag, logs a warning and writes an audit event.", "TestHardeningOverrideWarnsAndAudits"},
	{"Write-only secrets", "age-encrypted at rest, injected at runtime, redacted from every log, BuildKit secret mounts only.", "TestSecretsNeverInLogs, TestBuildSecretsNotInImageLayers"},
	{"Tamper-evident audit log", "Every state change is a SHA-256 hash-chained, append-only event; verifiable online and offline.", "TestAuditChainVerifiesAndDetectsTampering, TestEveryStateChangeWritesAuditEvent"},
	{"RBAC in the service layer", "Owner / Admin / Deployer / Viewer checked by every service method, not the router or UI.", "TestRBACEnforcedInServices, TestViewerCannotDeployOrRevealSecrets"},
	{"Dashboard on localhost", "The control plane is published on 127.0.0.1:8443 only; exposure is an explicit operator action.", "TestDashboardBindsLocalhostByDefault"},
	{"Mandatory strong auth", "argon2id passwords, TOTP second factor, lockout and rate limiting.", "TestLoginLockoutAfterFailures, TestRateLimitReturns429"},
	{"Scanned supply chain", "Trivy gate and Syft SBOM per deployment; release artifacts cosign-signed and verified before an update.", "TestCriticalCVEBlocked, TestUpdateVerifiesCosignSignature"},
}

var PostureTSC = []TSCRow{
	{"CC6.1", "Logical access controls", "Role matrix enforced server-side; sessions with TOTP; write-only secrets; every auth and role event on the audit chain (auth.*, user.*)."},
	{"CC6.6 / CC6.7", "Boundary protection, transmission", "Localhost-only control plane, per-app networks, TLS via ACME for every app hostname, socket-proxy allow-list."},
	{"CC7.1 / CC7.2", "Vulnerability and anomaly monitoring", "Trivy scan gate with per-app policy, SBOM per release, self-audit posture checks, lockout and rate-limit audit events."},
	{"CC7.3 / CC7.4", "Evaluation and response", "Hash-chained audit export (JSONL/CSV) with offline verification; failed deployments surface logs without secret values."},
	{"CC8.1", "Change management", "Every deployment, rollback, secret change and configuration change is an audited, attributable event with health-gated cutover."},
	{"A1.2 / A1.3", "Availability, backup and recovery", "Scheduled age-encrypted addon backups to object storage, restore into a fresh addon, Litestream replication of the control-plane database."},
}