Bind sender identities, add operator read surface, real serving layer

AUDIT-WP-0004 T03, T05, T06.

T03 - the receiver accepted whatever tenant and source a caller sent as long
as it held the one shared token, despite WP-0003 recording tenant isolation as
delivered. audit_core.senders binds each credential to the sources and tenants
it may assert, driven by AUDIT_CORE_SENDERS rather than literals. Identities
hold a list of tokens so rotation publishes the replacement alongside the
incumbent and needs no delivery gap. Read is a separate privilege from write,
so a sender credential cannot read the audit trail back.

T05 - lookup by event id, lookup by correlation id, and a dead-letter view.
Rejections are recorded rather than silently dropped. An event rejected for
carrying secret-shaped material has its payload withheld: storing it would
write that material into the audit store, which is what the rejection exists
to prevent. Reason and payload hash are kept so it stays traceable.

Replay is deliberately not built here. Idempotent replay is a property of the
durable store and building it against SQLite would produce a second
implementation to throw away; it lands with the Postgres backend in
AUDIT-WP-0005-T01.

T06 - serving moves to waitress with configurable threads and channel timeout,
installed in the image via the serve extra. Without it the entrypoint falls
back to a threaded wsgiref server with a socket timeout and graceful shutdown
on SIGTERM, and logs a warning so a deployment cannot quietly land on the
fallback. Metric counters deferred to WP-0005-T03 to be designed against the
real scrape path.

Tests 36 -> 46, covering cross-tenant and cross-source refusal, token
rotation, read/write privilege separation, correlation lookup, and payload
withholding on secret rejection.

Remaining in WP-0004: T04 redaction policy, which needs a decision on whether
a secret-shaped field is a rejection or a redaction.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

audit_core/sqlite_backend.py

@@ -34,8 +34,25 @@ CREATE TABLE IF NOT EXISTS events (
 );
 CREATE INDEX IF NOT EXISTS events_correlation_idx ON events (correlation_id);
 CREATE INDEX IF NOT EXISTS events_tenant_idx ON events (tenant);
+
+CREATE TABLE IF NOT EXISTS dead_letters (
+  id            INTEGER PRIMARY KEY AUTOINCREMENT,
+  event_id      TEXT,
+  received_at   TEXT NOT NULL,
+  sender        TEXT,
+  reason        TEXT NOT NULL,
+  payload_hash  TEXT NOT NULL,
+  payload       TEXT,
+  payload_withheld INTEGER NOT NULL DEFAULT 0
+);
+CREATE INDEX IF NOT EXISTS dead_letters_event_idx ON dead_letters (event_id);
 """
 
+# Rejection reasons whose payload must never be persisted. Storing the body of
+# an event rejected *for containing secret-shaped material* would write that
+# material into the audit store — the precise outcome the rejection prevents.
+WITHHOLD_PAYLOAD_REASONS = frozenset({"secret_shaped_field"})
+
 
 class SQLiteAuditBackend:
     """Store audit events in SQLite with idempotent accept semantics.
@@ -147,6 +164,86 @@ class SQLiteAuditBackend:
             )
         return AcceptResult(duplicate=True, reference=reference)
 
+    # --- operator read surface (AUDIT-WP-0004-T05) --------------------------
+
+    def get(self, event_id: str) -> dict | None:
+        """Return one stored event record, or None."""
+        row = self._query(
+            "SELECT record, accepted_at FROM events WHERE event_id = ?", (event_id,)
+        )
+        if not row:
+            return None
+        return {"accepted_at": row[0][1], **json.loads(row[0][0])}
+
+    def by_correlation(self, correlation_id: str, limit: int = 100) -> list[dict]:
+        """Return every stored event carrying ``correlation_id``, oldest first."""
+        rows = self._query(
+            "SELECT record, accepted_at FROM events WHERE correlation_id = ? "
+            "ORDER BY accepted_at, event_id LIMIT ?",
+            (correlation_id, int(limit)),
+        )
+        return [{"accepted_at": at, **json.loads(rec)} for rec, at in rows]
+
+    def record_rejection(
+        self,
+        *,
+        event_id: str | None,
+        reason: str,
+        payload_hash: str,
+        sender: str | None = None,
+        payload: str | None = None,
+    ) -> None:
+        """Record a rejected event so it is visible to an operator.
+
+        A rejection is not a silent drop: the sender dead-letters the event and
+        somebody has to be able to see why. The payload is withheld when the
+        rejection reason implies it carries secret-shaped material.
+        """
+        withheld = reason in WITHHOLD_PAYLOAD_REASONS
+        try:
+            self.db.execute(
+                "INSERT INTO dead_letters "
+                "(event_id, received_at, sender, reason, payload_hash, payload, payload_withheld) "
+                "VALUES (?, ?, ?, ?, ?, ?, ?)",
+                (
+                    event_id,
+                    datetime.now(timezone.utc).replace(microsecond=0).isoformat(),
+                    sender,
+                    reason,
+                    payload_hash,
+                    None if withheld else payload,
+                    1 if withheld else 0,
+                ),
+            )
+        except sqlite3.Error as exc:
+            raise BackendUnavailableError(str(exc)) from exc
+
+    def dead_letters(self, limit: int = 100) -> list[dict]:
+        """Return recent rejections, newest first."""
+        rows = self._query(
+            "SELECT event_id, received_at, sender, reason, payload_hash, payload, "
+            "payload_withheld FROM dead_letters ORDER BY id DESC LIMIT ?",
+            (int(limit),),
+        )
+        return [
+            {
+                "event_id": r[0],
+                "received_at": r[1],
+                "sender": r[2],
+                "reason": r[3],
+                "payload_hash": r[4],
+                "payload": r[5],
+                "payload_withheld": bool(r[6]),
+            }
+            for r in rows
+        ]
+
+    def _query(self, sql: str, params: tuple) -> list:
+        try:
+            return self.db.execute(sql, params).fetchall()
+        except sqlite3.Error as exc:
+            raise BackendUnavailableError(str(exc)) from exc
+
     def health(self) -> None:
         """Raise :class:`BackendUnavailableError` if the store is unusable."""
         try: