Bind sender identities, add operator read surface, real serving layer

AUDIT-WP-0004 T03, T05, T06.

T03 - the receiver accepted whatever tenant and source a caller sent as long
as it held the one shared token, despite WP-0003 recording tenant isolation as
delivered. audit_core.senders binds each credential to the sources and tenants
it may assert, driven by AUDIT_CORE_SENDERS rather than literals. Identities
hold a list of tokens so rotation publishes the replacement alongside the
incumbent and needs no delivery gap. Read is a separate privilege from write,
so a sender credential cannot read the audit trail back.

T05 - lookup by event id, lookup by correlation id, and a dead-letter view.
Rejections are recorded rather than silently dropped. An event rejected for
carrying secret-shaped material has its payload withheld: storing it would
write that material into the audit store, which is what the rejection exists
to prevent. Reason and payload hash are kept so it stays traceable.

Replay is deliberately not built here. Idempotent replay is a property of the
durable store and building it against SQLite would produce a second
implementation to throw away; it lands with the Postgres backend in
AUDIT-WP-0005-T01.

T06 - serving moves to waitress with configurable threads and channel timeout,
installed in the image via the serve extra. Without it the entrypoint falls
back to a threaded wsgiref server with a socket timeout and graceful shutdown
on SIGTERM, and logs a warning so a deployment cannot quietly land on the
fallback. Metric counters deferred to WP-0005-T03 to be designed against the
real scrape path.

Tests 36 -> 46, covering cross-tenant and cross-source refusal, token
rotation, read/write privilege separation, correlation lookup, and payload
withholding on secret rejection.

Remaining in WP-0004: T04 redaction policy, which needs a decision on whether
a secret-shaped field is a rejection or a redaction.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/test_ingestion.py

@@ -143,8 +143,9 @@ def test_rejects_truncated_body(app):
 # --- routing (T07) ----------------------------------------------------------
 
 @pytest.mark.parametrize("path,method", [
-    ("/v1/events", "GET"),
     ("/nope", "POST"),
+    ("/nope", "GET"),
+    ("/v1/events", "DELETE"),
 ])
 def test_unknown_routes_are_not_found(app, path, method):
     assert invoke(app, event(), path=path, method=method)[0].startswith("404")
@@ -220,3 +221,115 @@ def test_concurrent_duplicates_produce_exactly_one_record(tmp_path):
     assert outcomes.count("duplicate") == 15, outcomes
     stored = backend.db.execute("SELECT COUNT(*) FROM events").fetchone()[0]
     assert stored == 1
+
+
+# --- sender identity binding (T03) ------------------------------------------
+
+from audit_core.senders import SenderIdentity, SenderRegistry  # noqa: E402
+
+
+def bound_app(tmp_path, **kw):
+    identity = SenderIdentity(
+        name="user-engine",
+        tokens=kw.get("tokens", ("opaque",)),
+        sources=frozenset(kw.get("sources", {"user-engine"})),
+        tenants=frozenset(kw.get("tenants", {"tenant:friendly:binky"})),
+        may_read=kw.get("may_read", False),
+    )
+    backend = SQLiteAuditBackend(str(tmp_path / "bound.db"))
+    return IngestionApplication(backend, SenderRegistry([identity])), backend
+
+
+def test_credential_may_not_claim_another_tenant(tmp_path):
+    """The property WP-0003 recorded as done but never implemented."""
+    app, _ = bound_app(tmp_path)
+    assert invoke(app, event())[0].startswith("202")
+    status, body = invoke(app, event(tenant="tenant:coulomb"))
+    assert status.startswith("400")
+    assert body["error"] == "tenant_not_allowed"
+
+
+def test_credential_may_not_claim_another_source(tmp_path):
+    app, _ = bound_app(tmp_path)
+    status, body = invoke(app, event(source="issue-core"))
+    assert status.startswith("400")
+    assert body["error"] == "source_not_allowed"
+
+
+def test_rotation_accepts_both_tokens(tmp_path):
+    """Rotation must not need a delivery gap."""
+    app, _ = bound_app(tmp_path, tokens=("current", "next"))
+    assert invoke(app, event(), token="current")[0].startswith("202")
+    assert invoke(app, event(id="evt-2"), key="evt-2", token="next")[0].startswith("202")
+    assert invoke(app, event(id="evt-3"), key="evt-3", token="retired")[0].startswith("401")
+
+
+def test_sender_credential_cannot_read_the_trail_back(tmp_path):
+    app, _ = bound_app(tmp_path, may_read=False)
+    assert invoke(app, event())[0].startswith("202")
+    status, body = invoke(app, None, path="/v1/events/evt-1", method="GET", body=b"")
+    assert status.startswith("403")
+    assert body["error"] == "read_forbidden"
+
+
+# --- operator read surface (T05) --------------------------------------------
+
+def test_lookup_by_event_id_and_correlation(app):
+    assert invoke(app, event())[0].startswith("202")
+    assert invoke(app, event(id="evt-2", correlation_id="corr-1"), key="evt-2")[0].startswith("202")
+
+    status, body = invoke(app, None, path="/v1/events/evt-1", method="GET", body=b"")
+    assert status.startswith("200")
+    assert body["event_id"] == "evt-1"
+    assert body["tenant"] == "tenant:friendly:binky"
+
+    status, body = invoke_query(app, "correlation_id=corr-1")
+    assert status.startswith("200")
+    assert {e["event_id"] for e in body["events"]} == {"evt-1", "evt-2"}
+
+
+def invoke_query(app, query, token="opaque"):
+    environ = {
+        "PATH_INFO": "/v1/events",
+        "REQUEST_METHOD": "GET",
+        "QUERY_STRING": query,
+        "CONTENT_LENGTH": "0",
+        "wsgi.input": io.BytesIO(b""),
+        "HTTP_AUTHORIZATION": f"Bearer {token}",
+    }
+    result = {}
+    out = b"".join(app(environ, lambda status, headers: result.update(status=status)))
+    return result["status"], (json.loads(out) if out else {})
+
+
+def test_unknown_event_id_is_not_found(app):
+    status, _ = invoke(app, None, path="/v1/events/nope", method="GET", body=b"")
+    assert status.startswith("404")
+
+
+def test_correlation_lookup_requires_a_correlation_id(app):
+    status, body = invoke_query(app, "")
+    assert status.startswith("400")
+    assert body["error"] == "correlation_id_required"
+
+
+def test_rejected_events_appear_as_dead_letters(app):
+    assert invoke(app, event(source="issue-core"))[0].startswith("400")
+    status, body = invoke(app, None, path="/v1/dead-letters", method="GET", body=b"")
+    assert status.startswith("200")
+    entry = body["dead_letters"][0]
+    assert entry["reason"] == "source_not_allowed"
+    assert entry["event_id"] == "evt-1"
+    assert entry["payload"] is not None
+
+
+def test_secret_rejection_withholds_the_payload(app):
+    """Storing the body of an event rejected for carrying secret-shaped
+    material would write that material into the audit store."""
+    assert invoke(app, event(data={"password": "hunter2"}))[0].startswith("400")
+    _, body = invoke(app, None, path="/v1/dead-letters", method="GET", body=b"")
+    entry = body["dead_letters"][0]
+    assert entry["reason"] == "secret_shaped_field"
+    assert entry["payload_withheld"] is True
+    assert entry["payload"] is None
+    assert entry["payload_hash"]