coulomb/audit-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record native sender acceptance and retained audit readback gate
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-11 14:23:07 +02:00
parent 9cc500219c
commit 0b30bfb08c
2 changed files with 537 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

49
workplans/AUDIT-WP-0009-evidence-role-conformance.md
View file

@ -287,6 +287,13 @@ status: progress
priority: high
state_hub_task_id: "fd4a4ac3-e525-57c1-9179-e0fcd0226913"
```
**Current native return, 2026-09-11 10:42 UTC:** custody/ESO delivery,
source-adapter accepted write, duplicate-after-process-restart, exact scope/read
refusals and own reconciliation count one passed. Independent archive readback
and audit bearer revocation remain; service/domain-transaction/human operation
is separate. See the retained native producer receipt and attempt history below.
Register `approval-engine` as a distinct source under §9.4 and `AUDIT-IN-0001`:
sender registration, the four event classes (issuance, use, supersession,
revocation), tenancy mapping, retention profile, `secret_policy`, and
@ -391,6 +398,13 @@ status: progress
priority: high
state_hub_task_id: "96e0cbd5-e3ce-5807-8f64-41244671327b"
```
**Current native return, 2026-09-11 10:42 UTC:** custody/ESO delivery,
source-adapter accepted write, duplicate-after-process-restart, exact scope/read
refusals and own reconciliation count one passed. Independent archive readback
and audit bearer revocation remain; service/domain-transaction/human operation
is separate. See the retained native producer receipt and attempt history below.
Register `informed-decision` as a distinct load-bearing source under
`AUDIT-IN-0003`, and answer the doctrine question `GH-DEC-2026-014` put to
audit-core: whether the record shape can carry a source-held-content
@ -545,6 +559,41 @@ service/outbox/recovery and first-heartbeat operation remain unproved; ESO
reader-session revocation is a separate control from audit bearer revocation.
T12 still owns attestation/offsite operation; tamper_evidence=false is accurate.
### Native producer return — 2026-09-11 10:42 UTC
Both actual source adapters used their own ESO-delivered credential inside a
bounded native Job. Each synthetic event received 202, retained its durable
outbox after an injected lost receipt, and received duplicate 200 after a fresh
process reopened the outbox. Each source's reconciliation reported exactly one
record for its unique probe class. Wrong source/tenant, seven archive read
routes, sibling reconciliation and invalid-bearer requests were refused.
The first Informed Decision probe exposed a private-store startup defect:
fsGroup volumes add inherited setgid to a newly created 0700 directory.
Informed Decision `1a12223` corrects creation without repairing unsafe existing
data. The regression failed before the fix; the available suite now passes
335 tests with 39 optional checks skipped. Native retry verifies the exact
corrected helper. Six probe tests and eleven rebuilt-container checks pass,
including actual setgid-volume startup, restart/restore and cleanup.
All temporary probe Jobs, Pods, ConfigMaps and NetworkPolicies are verified
absent. Receiver c82e0442 remains operational/durable; tamper_evidence=false.
Producer verification requires no operator registry read or new OpenBao login.
Independent readback is a separate attended command consuming the successful
receipt; it must not rerun the producer jobs. Both attended verification-login
attempts this session ended before handoff (exit 5; remote revocation
unconfirmed), so independent archive readback remains pending.
This proves synthetic outbox delivery/recovery with native sender credentials,
not domain-transaction atomicity, deployed producer services or human binding.
An invalid bearer is not a revoked formerly valid bearer. AUDIT T09/T11 and
RPF T08 remain progress for independent readback and audit bearer-revocation
acceptance; CCR21/22 remain applied. Service/policy/human admission and native
runtime/spend gates remain separate. Factory attempts and paid calls remain 0.
[Native producer receipt](../docs/evidence/2026-09-11-factory-native-producers.json).
## Operate the scheduled attestation and independent offsite return
```task