# Platform approval audit sender

Source return for `APPROVAL-WP-0002-T01/T04` and `AUDIT-WP-0009-T09`,
2026-09-08. This records the existing platform store's required registration;
it neither provisions a credential nor admits another tenant.

| Field | Required value |
| --- | --- |
| Sender and permitted source | `approval-engine` (exact) |
| Tenants | `["tenant:platform"]` (exact) |
| Write / read | `true` / `false` |
| Evidence kind | `load-bearing` |
| Completeness trade | none |
| Secret policy | `redact` |
| Consumer mount | Secret `approval-engine/approval-engine-audit`, key `audit-token` |

The accepted platform tenant decision is already implemented in the Engine
default, production CLI and deployment arguments. The audit envelope carries
that same store tenant without normalization. This is the tenant list Audit
Core requested; neither `platform`, `tenant:coulomb`, nor `*` is required.
A future store serving another tenant needs a separate registration review.

Choose `redact` explicitly: the receiver should retain a legitimate revocation
record with an accidentally secret-shaped field removed, rather than reject
the event and leave its delivery pending. Approval payloads must still contain
no credentials. Redaction findings do not excuse a producer defect.
Audit Core's scope overlay does not set this field; the protected sender
registry entry must explicitly carry `secret_policy: redact` when provisioned.

The transactional outbox emits issuance, use, supersession and revocation;
heartbeat uses the same durable drain. Its atomicity and retry contract remain
in [outbox-contract.md](outbox-contract.md). Receiver identity/scope/ingress and
credential admission precede live drain proof. Attestation freshness, omission
detection and reconciliation retain their separate AUDIT-WP-0009-T02/T04/T06
owners and bounds; this registration does not claim their completion.

First provisioning still requires the platform-owned custody record linking
the receiver's protected sender registry and this mounted credential. No
credential value belongs in this document, Git, Hub or a rollout receipt.