2026-06-22 17:52:32 +02:00
|
|
|
# SCOPE
|
|
|
|
|
|
|
|
|
|
> This file was generated by `statehub register`. Refine it as the repository
|
|
|
|
|
> boundaries become clearer.
|
|
|
|
|
|
|
|
|
|
## One-liner
|
|
|
|
|
|
|
|
|
|
Reliable multi-tenant auto setup audit capability.
|
|
|
|
|
|
|
|
|
|
## Core Idea
|
|
|
|
|
|
|
|
|
|
audit-core exists to provide the capability described in INTENT.md.
|
|
|
|
|
|
|
|
|
|
## In Scope
|
|
|
|
|
|
|
|
|
|
- Maintain the repository's primary implementation.
|
|
|
|
|
- Keep docs, tests, and operational metadata current.
|
2026-08-16 00:24:33 +02:00
|
|
|
- Operational audit custody (`operations.audit`) and its declared recovery bound.
|
2026-06-22 17:52:32 +02:00
|
|
|
|
|
|
|
|
## Out of Scope
|
|
|
|
|
|
|
|
|
|
- Own unrelated adjacent systems.
|
|
|
|
|
- Make irreversible operational decisions without human approval.
|
2026-08-16 00:24:33 +02:00
|
|
|
- Procuring or operating S3 / Barman / WAL.
|
|
|
|
|
- Booked cost or a second usage stream for `platform:audit-storage`.
|
|
|
|
|
- A `rapp.yaml` in this repo (schema requires `rapp-*`).
|
|
|
|
|
- Public ingest.
|
2026-06-22 17:52:32 +02:00
|
|
|
|
|
|
|
|
## Current State
|
|
|
|
|
|
2026-08-16 00:24:33 +02:00
|
|
|
- Status: production
|
2026-08-15 20:45:13 +02:00
|
|
|
- Production receiver on railiance01 (`namespace audit-core`), Postgres
|
2026-08-16 00:24:33 +02:00
|
|
|
operational custody on `platform-pg`, sender `user-engine`.
|
2026-08-16 01:23:54 +02:00
|
|
|
- Recovery is the platform `data.backup` window (30 days). Live `/readyz`
|
|
|
|
|
reports `custody_class=operational`, `tamper_evidence=true`,
|
|
|
|
|
`recoverable_days=30` (image `sha256:7febc28e…`).
|
|
|
|
|
- Hash chain verified on 30 live events
|
|
|
|
|
(`docs/evidence/chain-head-20260816.json`).
|
|
|
|
|
- ITC-CAP case: `data/capability/audit-core-operational.json` at D4.
|
|
|
|
|
`data.archive` is an unmet requirement.
|
2026-08-18 15:20:58 +02:00
|
|
|
- Tenancy posture: `tenancy.yaml` (NetKingdom Tenancy Posture v0.1 draft-8,
|
Declare the tenancy posture vector (AUDIT-WP-0008-T01).
Written against draft-7, which landed after the task was drafted and moved the
target. Decision 5.4 fixes the location at tenancy.yaml in the repo root rather
than docs/, and fixes the schema: current, target, reviewed, gap,
placement_exceptions, service_class, per-path detail, provider block.
Declares I1 A2 E1 P1 R1. E is quoted at 1 although T04 put the E2 mechanism on
both paths, because §13.2 states a passing CI run is not E2 evidence -- the
artifact is adversarial, compares separate tenant contexts and carries a review
date. Our cross-tenant tests are mechanical, so under §13.1 the level is not
claimable until T05. The mechanism is recorded in paths.E and the reason in
gap.E. Claiming E2 off unit tests would be the overclaim §6 prohibits, and
refusing that reasoning is what found the read-path defect.
R stays at 1: R2 needs backupRetentionDays in rapp-postgres's consumer file,
requested in T02 and not ours to declare.
Two additions draft-7 forced. A credentials gap under Decision 9.2 -- our own
finding, adopted as a rule, and it binds us: ingest credentials are static
long-lived bearer tokens, declared as a stated gap rather than a silent
exclusion. And a provides block under Decision 5.5, declaring what a sender can
reach through this service: E2 now, E3 pending ADR-0003, E4 and R4 unreachable.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-17 22:55:31 +02:00
|
|
|
Decision 5.4). Declared `I1 A2 E1 P1 R1`, target `E3` and `R2`. E is quoted
|
|
|
|
|
at 1 although the E2 mechanism is in place on both paths — the §13 E2
|
|
|
|
|
artifact is adversarial and does not exist yet (AUDIT-WP-0008-T05).
|
2026-06-22 17:52:32 +02:00
|
|
|
|
|
|
|
|
## Getting Oriented
|
|
|
|
|
|
|
|
|
|
- Start with: INTENT.md
|
|
|
|
|
- Agent instructions: AGENTS.md
|
|
|
|
|
- Workplans: workplans/
|