From b46b0f26669dc83c944ee5145426bad03d5ef720 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 8 Sep 2026 17:01:42 +0200 Subject: [PATCH] docs(admission): resolve approval audit tenant and redaction inputs Assistant: codex Assistant-Model: gpt-5.6-luna Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc --- docs/audit-source-registration.md | 39 +++++++++++++++++++ docs/outbox-contract.md | 2 +- tests/test_audit.py | 1 + ...duction-readiness-and-consumer-adoption.md | 8 ++++ 4 files changed, 49 insertions(+), 1 deletion(-) create mode 100644 docs/audit-source-registration.md diff --git a/docs/audit-source-registration.md b/docs/audit-source-registration.md new file mode 100644 index 0000000..8b9ef5b --- /dev/null +++ b/docs/audit-source-registration.md @@ -0,0 +1,39 @@ +# Platform approval audit sender + +Source return for `APPROVAL-WP-0002-T01/T04` and `AUDIT-WP-0009-T09`, +2026-09-08. This records the existing platform store's required registration; +it neither provisions a credential nor admits another tenant. + +| Field | Required value | +| --- | --- | +| Sender and permitted source | `approval-engine` (exact) | +| Tenants | `["tenant:platform"]` (exact) | +| Write / read | `true` / `false` | +| Evidence kind | `load-bearing` | +| Completeness trade | none | +| Secret policy | `redact` | +| Consumer mount | Secret `approval-engine/approval-engine-audit`, key `audit-token` | + +The accepted platform tenant decision is already implemented in the Engine +default, production CLI and deployment arguments. The audit envelope carries +that same store tenant without normalization. This is the tenant list Audit +Core requested; neither `platform`, `tenant:coulomb`, nor `*` is required. +A future store serving another tenant needs a separate registration review. + +Choose `redact` explicitly: the receiver should retain a legitimate revocation +record with an accidentally secret-shaped field removed, rather than reject +the event and leave its delivery pending. Approval payloads must still contain +no credentials. Redaction findings do not excuse a producer defect. +Audit Core's scope overlay does not set this field; the protected sender +registry entry must explicitly carry `secret_policy: redact` when provisioned. + +The transactional outbox emits issuance, use, supersession and revocation; +heartbeat uses the same durable drain. Its atomicity and retry contract remain +in [outbox-contract.md](outbox-contract.md). Receiver identity/scope/ingress and +credential admission precede live drain proof. Attestation freshness, omission +detection and reconciliation retain their separate AUDIT-WP-0009-T02/T04/T06 +owners and bounds; this registration does not claim their completion. + +First provisioning still requires the platform-owned custody record linking +the receiver's protected sender registry and this mounted credential. No +credential value belongs in this document, Git, Hub or a rollout receipt. diff --git a/docs/outbox-contract.md b/docs/outbox-contract.md index 90dce67..eb0f78c 100644 --- a/docs/outbox-contract.md +++ b/docs/outbox-contract.md @@ -55,7 +55,7 @@ emitted class. The validity window is already on the object. "schema_version": "audit-core.event.v1alpha1", "event_id": "", "observed_at": "", - "tenant": "platform", + "tenant": "tenant:platform", "scope": "netkingdom-approvals", "source": "approval-engine", "actor": "", diff --git a/tests/test_audit.py b/tests/test_audit.py index a2eba0e..74a1802 100644 --- a/tests/test_audit.py +++ b/tests/test_audit.py @@ -42,6 +42,7 @@ def test_audit_sender_adapts_envelope_and_rereads_token(tmp_path): assert body["id"] == body["correlation_id"] or body["correlation_id"] assert body["type"] == "approval.issuance" assert body["source"] == "approval-engine" + assert body["tenant"] == "tenant:platform" engine.close() diff --git a/workplans/APPROVAL-WP-0002-production-readiness-and-consumer-adoption.md b/workplans/APPROVAL-WP-0002-production-readiness-and-consumer-adoption.md index 2e9fad5..06f4824 100644 --- a/workplans/APPROVAL-WP-0002-production-readiness-and-consumer-adoption.md +++ b/workplans/APPROVAL-WP-0002-production-readiness-and-consumer-adoption.md @@ -332,6 +332,14 @@ urllib `HTTPError` 503 as pending. Waiting on the audit-core sender registration/ingress and receiver-owned reconciliation work (`AUDIT-WP-0009-T04/T06/T09`). +2026-09-08 critical-path return: `docs/audit-source-registration.md` resolves +Audit Core's tenant and redaction questions from the existing sanctioned store +contract: exact `tenant:platform`, source `approval-engine`, write-only, +load-bearing, explicit `redact`. The outbox example and envelope test now pin +the same tenant. This closes those source-input waits, not live registration. +Platform still owes linked receiver/sender custody and the protected token; +T04 stays wait for admission and live drain/reconciliation evidence. + ## Prove one live PEP consumption path ```task