What a self-report is
Runtime identity, in Contour's vocabulary, is the runtime reporting which release it loaded, under which runtime policy. The report comes from the worker itself, which is why every screen that shows one says worker self-report.
What it can show
When the report names a different release from the approved one, that difference is worth acting on, whatever else is uncertain. A sequence of reports also gives a history: when the update was approved, when the runtime caught up, and when it went quiet.
What it cannot show
A report cannot vouch for itself. A faulty or compromised runtime could report anything. Binding a report to the measured state of the machine is the job of hardware attestation, which Contour does not claim.
When it was true
A report describes a moment. Without a way to show that a report is current rather than stale, an old report can look like a new one. Heartbeat freshness for runtime reports is on Contour's Planned next list.
