Agent Evidence Admission

Agent Evidence Admission carries four policy engines that decide whether a Kubernetes workload may run, on the strength of an in-toto attestation describing what an automated agent did while producing it. The Rego rail is rego/execution_evidence.rego.

The point of the repository is the honesty of its coverage table rather than the policy itself. PROFILE-REGISTRY.md records, obligation by obligation, whether each engine enforces it, approximates it, or cannot reach it, and scripts/profile-map-gate.py refuses a row that claims enforcement the run does not support. A reader can rebuild every one of those claims from a fresh clone in four commands, which is the property the project is built around: an admission decision nobody can re-derive is a decision you have to take on trust.