Skip to content
ELEMENT 31

Watchman

Watchman is the Substrate service that continuously verifies the signed software image and the enclosure's tamper indicators, writing any deviation to an append-only record.

· 2 min read

IN SHORT

Watchman is the Substrate service responsible for continuous integrity verification. It checks that the node is running the sealed, signed, read-only software image it claims to run and that the enclosure's tamper indicators are intact. Any deviation is written to an append-only record on the appliance, where the site can read it and no one can edit it.

Watchman is the Substrate service that continuously verifies the integrity of a Czar node: the signed, read-only software image it runs and the tamper indicators on its sealed enclosure. Deviations are written to an append-only record on the appliance.

Why it matters

Every claim a site makes about its serving platform rests on one assumption: that the platform running on the floor is the platform that was installed. If the image has been altered or the enclosure opened, every other statement about posture, records, and behavior is in doubt. Watchman is the service that keeps that assumption checkable.

It matters especially on sites that never phone home. There is no vendor watching the appliance from outside, so the appliance has to watch itself and show the site what it sees. An auditor asking whether the platform was intact during a particular period gets an answer from the Watchman record, held locally, rather than from a vendor's assurance.

How it works here

The software image on a Czar is sealed, signed, and read-only. Watchman verifies continuously that what is running matches the signature. At the same time it monitors the enclosure's tamper indicators. Both checks run for as long as the node is powered, on every posture.

When either check deviates, Watchman writes an entry to an append-only record. Entries are added and never changed. The record is exposed on the facility network under the site's access control, alongside the Evaluation traces and serving health, so the site's monitoring reads it the way it reads everything else about the platform.

Watchman is the running counterpart to attestation. A node attests what it is running before it joins a Grid or accepts work; Watchman confirms that the attestation remains true afterward. After a signed update is loaded, Watchman verifies against the new image. After a rollback, it verifies against the previous one. The provenance record documents which image that is at any point in the node's history.

  • Substrate: the platform Watchman belongs to.
  • Local Bridge: the connectivity service whose refusals share the same body of records.
  • Inference service: the serving service whose integrity Watchman underwrites.
  • Adapter: a site-trained artifact loaded onto the verified image.

Questions this raises

What is the difference between Watchman and attestation?
Attestation is a node declaring what it is running at a moment, before it joins a Grid or accepts work. Watchman is the continuous check that the declaration stays true afterward, for as long as the node runs.
Where does the Watchman record go?
It stays on the appliance. It is append-only, exposed on the facility network under the site's access control, and read by the site's own monitoring. It is never sent to Element 31 or anywhere else.
What happens when Watchman records a deviation?
The entry appears in the record and in whatever alerting the site has wired to it. What the site does next is the site's decision; the platform's job is to notice, write it down where it cannot be erased, and make it visible.

KEEP READING

Related.