docs: answer EU AI Act GKE governance assessment

[Igor Holt (igor-holt)]

Summary

Answers all nine EU AI Act governance controls for the Self-Evolving Retrainer × GKE Pod Network Manager scope and adds the supporting operating records.

Decision

• Approved: shadow/read-only evidence collection and human-reviewable change planning.
• Not approved: active GKE mutation, production deployment, or on-chain publication.
• Assessment status: blocked_pending_external_legal_and_production_remediation.

Control results

All nine questions now have an owner, answer, rationale, evidence references, and a residual-gap statement. Partial answers remain fail-closed rather than being converted into unsupported approvals.

Added artifacts

• eu_ai_act_driver_upgraded_assessment.yml — answered v2.1 assessment
• assessment-summary.json — machine-readable control status
• risk-management-plan.md
• data-governance-register.yml
• incident-response-and-post-market-monitoring.md
• decision-reproduction-requirements.md

Hard production blockers

1. Independent legal/classification reviewer is unassigned.
2. April 2026 critical/high security findings lack independent closure evidence.
3. Exact GKE region/VPC/subnet/ranges and separate read-only/mutation identities are unverified.
4. Exact model/runtime/retrieval semantic replay is incomplete.
5. Immutable log anchoring and retention enforcement are unverified.
6. Cloudflare production resources and secrets are unverified or placeholder-bound.
7. Alchemy team/app access and the canonical Base contract are unverified.

This PR intentionally remains a draft. It is an engineering assessment and operating-policy change, not a legal opinion, conformity assessment, or production-activation approval.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[gemini-code-assist]

Code Review

This pull request introduces comprehensive governance and compliance documentation for the Self-Evolving Retrainer and GKE Pod Network Governance system under the EU AI Act, including risk management, data governance, and incident response plans. The reviewer feedback correctly identifies that using symmetric HMAC-SHA256 signatures for evidence signing is incompatible with the planned on-chain verification on the Base network, and recommends transitioning to asymmetric ECDSA signing across the assessment configuration and risk management plan.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Using HMAC-SHA256 (a symmetric key algorithm) for signed evidence is incompatible with public or on-chain verification (such as the Base network attestation specified in the attestation control). To verify an HMAC signature on-chain, the symmetric secret would have to be exposed, compromising its security. Consider using an asymmetric signing algorithm (e.g., ECDSA with secp256k1 or Ed25519) and referencing a private key instead of a shared HMAC secret.

    algorithm: ECDSA-secp256k1
    secret_reference: GKE_EVIDENCE_SIGNING_PRIVATE_KEY

[gemini-code-assist]

To align with the recommendation of using asymmetric cryptography for on-chain verification on the Base network, update the preventive control from HMAC-SHA256 to ECDSA.

Suggested change

	| Evidence tampering | Canonical JSON, SHA-256, HMAC-SHA256, evidence-bound SETTLE | Signature verification | Reject and rotate signer if compromise suspected | Tested; signer provisioning unverified |
	| Evidence tampering | Canonical JSON, SHA-256, ECDSA, evidence-bound SETTLE | Signature verification | Reject and rotate signer if compromise suspected | Tested; signer provisioning unverified |