Enforce residency
Scheduling rejects nodes outside an allowed region. Request constraints can also deny calls when the eligible endpoint set violates residency policy.
Sovereignty
Enforce where work may run. Record why a call was allowed.
Dodona turns sovereignty into inspectable policy and signed evidence. It does not claim legal compliance certification.
Enforce · record · verify
Policy exists at placement time and request time.
Record decisions
Audit entries include the authenticated actor, service, constraint, enforcement point, and allow or deny result in a hash chain.
Verify offline
Attestation reports are signed over the chain head. A verifier can check the report without contacting the running control plane.
Chain integrity
An external head anchor detects whole-chain rollback.
Dodona can publish signed audit-head anchors. Comparing a report to an external head detects replacement of the complete local chain before the report was generated.
The completeness limit is explicit
A service-filtered report can omit entries while still declaring the global head. Per-service inclusion proofs are future work. The signed chain proves integrity of the entries supplied; it does not yet prove that every entry relevant to one service was included.
Boundary
These mechanisms are policy enforcement and evidence primitives. They are not a legal compliance certification, auditor opinion, or guarantee about an operator’s surrounding controls.
Next step
Evaluate the verifier, not a promise.
The current early-access path can provide a signed checkpoint and the repository’s attestation verification workflow.