diff --git a/workplans/AUDIT-WP-0003-user-engine-event-ingestion-service.md b/workplans/AUDIT-WP-0003-user-engine-event-ingestion-service.md index e3566db..3eacde1 100644 --- a/workplans/AUDIT-WP-0003-user-engine-event-ingestion-service.md +++ b/workplans/AUDIT-WP-0003-user-engine-event-ingestion-service.md @@ -11,7 +11,7 @@ created: "2026-08-08" updated: "2026-08-10" depends_on: - NK-WP-0024 -state_hub_workstream_id: "d2726f51-2beb-4c6b-96c4-98d29d11a93f" +state_hub_workstream_id: "8c2cfd72-126d-517e-8032-1f5c5cdaa20f" --- # AUDIT-WP-0003 - user-engine event ingestion service @@ -26,7 +26,7 @@ do not turn user-engine into an audit-retention service. id: AUDIT-WP-0003-T01 status: done priority: high -state_hub_task_id: "620a6910-60d6-4ef0-b82b-37eacb2fcf1d" +state_hub_task_id: "c9b402ae-3cc4-58c9-be37-c817db4d8145" ``` Map the user-engine envelope fields (id, type, source, subject, tenant, @@ -47,7 +47,7 @@ source, secret-shaped fields, and Idempotency-Key are validated. id: AUDIT-WP-0003-T02 status: done priority: high -state_hub_task_id: "a6fce44e-8977-47f0-8a75-9ce431cc27a6" +state_hub_task_id: "85df35ce-f6dd-5688-b38e-6b6678ada6e0" ``` Implement POST /v1/events with scoped workload authentication, schema @@ -69,7 +69,7 @@ All 15 repository tests pass. id: AUDIT-WP-0003-T03 status: cancel priority: high -state_hub_task_id: "fc0b5850-1954-448c-8729-ffe93d7b530f" +state_hub_task_id: "2c5a0a9f-53e1-5040-a86d-7fb724c5f9ec" ``` Publish an immutable image and deploy audit-core API plus durable backend on @@ -94,7 +94,7 @@ the receiver correctness work it depends on moves to AUDIT-WP-0004. id: AUDIT-WP-0003-T04 status: cancel priority: high -state_hub_task_id: "8d1624de-3e71-41c9-80ac-ab522313a0da" +state_hub_task_id: "7b1634a6-8b85-5e77-8f87-27f33074afc2" ``` Exercise successful delivery, receiver timeout/unavailability, bounded diff --git a/workplans/AUDIT-WP-0004-receiver-correctness-and-hardening.md b/workplans/AUDIT-WP-0004-receiver-correctness-and-hardening.md index dcfb767..2c207cb 100644 --- a/workplans/AUDIT-WP-0004-receiver-correctness-and-hardening.md +++ b/workplans/AUDIT-WP-0004-receiver-correctness-and-hardening.md @@ -9,7 +9,7 @@ owner: codex topic_slug: netkingdom created: "2026-08-10" updated: "2026-08-10" -state_hub_workstream_id: "f3345e90-f466-4184-b149-9b0be92ffec8" +state_hub_workstream_id: "7fcc4bbc-af6e-599c-be5c-a3930aea7773" --- # AUDIT-WP-0004 - receiver correctness and hardening @@ -43,7 +43,7 @@ WP-0005 against the interface this workplan fixes. id: AUDIT-WP-0004-T01 status: done priority: high -state_hub_task_id: "9b194ebc-f853-48c5-a65b-88b0eae3d7a2" +state_hub_task_id: "86474da6-6702-5ab7-97ac-8ff8b4683226" ``` `ingestion.py` writes records into SQLite directly and never calls @@ -84,7 +84,7 @@ connections and `BEGIN IMMEDIATE` around the insert/read pair. Now covered by id: AUDIT-WP-0004-T02 status: done priority: high -state_hub_task_id: "b193acaf-9c0e-411a-921b-13282bee8325" +state_hub_task_id: "1591c1ce-3c7b-528c-a9b5-5693ddd03a0d" ``` The handler catches `ValueError`, `TypeError`, `KeyError`, and @@ -121,7 +121,7 @@ docstring. id: AUDIT-WP-0004-T03 status: done priority: high -state_hub_task_id: "c29be4e7-4c2e-47f0-9d37-7d72061274ee" +state_hub_task_id: "9193c3e9-6bf6-50b0-a28b-38cbbe0c12a9" ``` WP-0003 T01 and T02 both record tenant isolation and cross-tenant claim @@ -152,7 +152,7 @@ grants every tenant and says so. id: AUDIT-WP-0004-T04 status: done priority: medium -state_hub_task_id: "5cf5c412-965a-4a56-aeef-e965f2861c51" +state_hub_task_id: "092b9a9d-d801-5170-bb01-4288424cb757" ``` `_contains_secret` rejects the entire event when any key name in `data` @@ -202,7 +202,7 @@ Contract updated to match; tests 46 -> 50. id: AUDIT-WP-0004-T05 status: done priority: high -state_hub_task_id: "006bc4ca-de36-4152-afae-0eef2a402e73" +state_hub_task_id: "9a1953d1-4528-5572-959d-57901218a9c1" ``` There is no way to read anything back. The failure matrix requires dead-letter @@ -242,7 +242,7 @@ AUDIT-WP-0005-T01, where `accept()` already gives it the semantics it needs. id: AUDIT-WP-0004-T06 status: done priority: high -state_hub_task_id: "348c2f4c-3ab0-46c7-9ddd-b198122f58ed" +state_hub_task_id: "28271d49-3aaa-5134-a1a0-e30ddad35e9d" ``` `wsgiref.simple_server` is single-threaded with no request timeout, no @@ -280,7 +280,7 @@ at now. id: AUDIT-WP-0004-T07 status: done priority: medium -state_hub_task_id: "b8141609-858d-41e1-9cc4-eb6f2723d561" +state_hub_task_id: "2fd0e7d2-ac5b-5d47-be70-743211039163" ``` Ingestion has two tests. Uncovered: oversized and zero-length bodies, absent diff --git a/workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md b/workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md index f6be215..40836f7 100644 --- a/workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md +++ b/workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md @@ -13,7 +13,7 @@ depends_on: - AUDIT-WP-0004 - RAPP-POSTGRES-WP-0002 - NK-WP-0024 -state_hub_workstream_id: "7b24a844-c9f2-4d2d-ac7d-20978bdf6b38" +state_hub_workstream_id: "a5983026-b50a-5545-9e64-b96baa568693" --- # AUDIT-WP-0005 - Postgres store and production deployment @@ -51,7 +51,7 @@ requirement and consumes it; it does not implement it here. id: AUDIT-WP-0005-T01 status: done priority: high -state_hub_task_id: "b1601d0b-922a-40f7-92c0-ea06af6c4468" +state_hub_task_id: "b7aa7e46-5874-5a8f-9dc7-203b15d28504" ``` Implement `AuditBackend` against PostgreSQL, declaring an honest @@ -117,7 +117,7 @@ cluster and belongs to T05. id: AUDIT-WP-0005-T02 status: done priority: high -state_hub_task_id: "831b2472-0d80-4369-a5e3-eb08ef3526b1" +state_hub_task_id: "428be448-dba5-5bda-b216-5944c7d17a75" ``` Declare audit-core's database requirement against rapp-postgres and take @@ -249,7 +249,7 @@ checksum. The receiver rolled successfully and `/readyz` remained durable id: AUDIT-WP-0005-T03 status: done priority: high -state_hub_task_id: "598af2ac-e772-4a4e-9a65-dde9d4ca167f" +state_hub_task_id: "170e4fb7-0683-5fc1-b8af-df639c5309ae" ``` Publish an immutable image — base pinned by digest, not a mutable tag, and @@ -354,7 +354,7 @@ T03 done. id: AUDIT-WP-0005-T04 status: done priority: medium -state_hub_task_id: "9010fb4a-a1b8-4ef7-b143-e33ca7cc0619" +state_hub_task_id: "378ec001-25ea-5aec-a6e8-f70d19ee4e7d" ``` Any events accepted by the pre-production SQLite receiver are audit records @@ -410,7 +410,7 @@ empty-source case that is today's actual situation. id: AUDIT-WP-0005-T05 status: done priority: high -state_hub_task_id: "1da30fec-b9f1-4be0-b42c-15797a8c4392" +state_hub_task_id: "ad6dece3-7ae9-5656-baae-feb6b8d54c72" ``` Exercise the deployed path: successful delivery; receiver timeout and @@ -478,7 +478,7 @@ locked in migration 0005. That JSON is the NK-WP-0024 hand-back. id: AUDIT-WP-0005-T06 status: done priority: medium -state_hub_task_id: "0856c80d-abe1-4bff-ba8d-87295cf76819" +state_hub_task_id: "a4c09b77-a7b0-5a8c-91f2-283ce65002e4" ``` Document what an operator needs: how to look up an event by correlation ID, diff --git a/workplans/AUDIT-WP-0006-honest-custody-and-canon-join.md b/workplans/AUDIT-WP-0006-honest-custody-and-canon-join.md index c00ee6d..e7d0e27 100644 --- a/workplans/AUDIT-WP-0006-honest-custody-and-canon-join.md +++ b/workplans/AUDIT-WP-0006-honest-custody-and-canon-join.md @@ -14,7 +14,7 @@ depends_on: - RESOURCE-WP-0002 - ITC-WP-0014 - ITC-WP-0015 -state_hub_workstream_id: "8d775ffb-3c83-4c33-9ffa-05ce52c5ff91" +state_hub_workstream_id: "21e7ccf8-703c-5631-95a2-b5a5743529b2" --- # AUDIT-WP-0006 — Honest operational custody against ITC-CAP and the live platform backup @@ -125,7 +125,7 @@ not build the sink here. id: AUDIT-WP-0006-T01 status: done priority: high -state_hub_task_id: "bbf476eb-7bc3-4cb6-bd1c-9b2c75903906" +state_hub_task_id: "27aa1df9-0758-5c2f-831b-29c41c2805a7" ``` `CustodyClass` is currently `development | archive | hot_search`. The @@ -180,7 +180,7 @@ is pinned** — the live image still reports `archive` and has no alias. id: AUDIT-WP-0006-T02 status: done priority: high -state_hub_task_id: "06907b2c-a822-48f0-8edc-50dd8914342b" +state_hub_task_id: "6d01629f-5d3f-5a83-9026-3b208f06dd89" ``` `docs/operator-runbook.md` still says production Barman is fail-closed @@ -219,7 +219,7 @@ sentence with RESOURCE-WP-0002-T05. Evidence JSON updated in place. id: AUDIT-WP-0006-T03 status: done priority: high -state_hub_task_id: "eba29df0-36b9-4f43-add6-760285c56bde" +state_hub_task_id: "dce899eb-7763-593b-a7d3-953d25f9e9c7" ``` Neighbours already restate real provisions against the live catalog @@ -292,7 +292,7 @@ status `production`. id: AUDIT-WP-0006-T04 status: done priority: medium -state_hub_task_id: "c5f5a883-834f-42eb-8f05-de2857d3904f" +state_hub_task_id: "a3d75c33-df62-5017-b54c-ebdc1165e469" ``` ITC-GOV / ITC-SEC / ITC-DATA say subsystems that produce Evidence @@ -329,7 +329,7 @@ template fields live under `consumer_profile` / `surfaces`. id: AUDIT-WP-0006-T05 status: done priority: medium -state_hub_task_id: "c629d894-2fe6-4b46-9909-7267d9170c84" +state_hub_task_id: "f40162fd-37fc-52c1-b5f1-a8b565ffda7d" ``` Inbox 2026-08-13 from net-kingdom (NK-WP-0024): live user-engine sender diff --git a/workplans/AUDIT-WP-0007-integrity-verification.md b/workplans/AUDIT-WP-0007-integrity-verification.md index e44155b..449298d 100644 --- a/workplans/AUDIT-WP-0007-integrity-verification.md +++ b/workplans/AUDIT-WP-0007-integrity-verification.md @@ -11,7 +11,7 @@ created: "2026-08-16" updated: "2026-08-16" depends_on: - AUDIT-WP-0006 -state_hub_workstream_id: "97946512-eb0a-4282-8c1f-f53d9ee25bfa" +state_hub_workstream_id: "5398f698-4f86-5dd8-962a-e5dbaf93c9f4" --- # AUDIT-WP-0007 — Integrity verification for operational custody @@ -67,7 +67,7 @@ remaining honesty gap on the live provision and is owned here. id: AUDIT-WP-0007-T01 status: done priority: high -state_hub_task_id: "d4423fd5-ad78-47d0-b85e-7ae6c582ec2b" +state_hub_task_id: "ea526d34-57e7-5273-b80b-6cd7bfe3bc1f" ``` Write a short contract in `docs/audit-backend-contract.md` (or a sibling @@ -98,7 +98,7 @@ and the six tests. id: AUDIT-WP-0007-T02 status: done priority: high -state_hub_task_id: "5830bb1a-27b7-4eed-b09f-75ba8cc9f7f1" +state_hub_task_id: "649a60b1-e8a7-59f5-9164-24c57290e163" ``` Add an additive migration (0006) for `chain_hash` (and `chain_prev` if @@ -124,7 +124,7 @@ write the next link under a lock. Conformance + `tests/test_integrity.py`. id: AUDIT-WP-0007-T03 status: done priority: high -state_hub_task_id: "fee1f93c-dcac-4fc3-9e41-17bb4436e8d6" +state_hub_task_id: "71b7faeb-1f70-5162-8ce1-3c3bbe849db1" ``` - CLI: `python -m audit_core verify-chain` (or equivalent) exits 0 @@ -148,7 +148,7 @@ test and Postgres superuser rewrite test both fail verify. id: AUDIT-WP-0007-T04 status: done priority: medium -state_hub_task_id: "b6d03d6a-0605-4982-a9a3-e18c89319ba9" +state_hub_task_id: "3b4d6b4e-1f72-5bc7-bf24-ca344caceaf6" ``` Publish `{chain_hash, event_id, accepted_at, event_count, observed_at}` @@ -179,7 +179,7 @@ RESOURCE-WP-0002-T06 logical-offsite. id: AUDIT-WP-0007-T05 status: done priority: medium -state_hub_task_id: "9fd70d3c-5a64-4b26-967f-4ef45394d81c" +state_hub_task_id: "f98fe8c8-637e-5e7d-bc3a-b2bedfc7525b" ``` After T03 and T04: diff --git a/workplans/AUDIT-WP-0008-tenancy-posture-alignment.md b/workplans/AUDIT-WP-0008-tenancy-posture-alignment.md index 3693076..f3c87ab 100644 --- a/workplans/AUDIT-WP-0008-tenancy-posture-alignment.md +++ b/workplans/AUDIT-WP-0008-tenancy-posture-alignment.md @@ -11,7 +11,7 @@ created: "2026-08-17" updated: "2026-08-22" depends_on: - AUDIT-WP-0007 -state_hub_workstream_id: "84c01552-4c65-45fd-bf6c-7daab0ecc9b6" +state_hub_workstream_id: "a9a248b2-d26c-503e-a8fc-4f3675e6ed51" --- # AUDIT-WP-0008 — Tenancy posture declaration and read-path enforcement @@ -280,7 +280,7 @@ both would be concealment, and §6 would be right to call it that. id: AUDIT-WP-0008-T01 status: done priority: high -state_hub_task_id: "65f3109a-fa98-459a-9e59-d7ac211bd2bc" +state_hub_task_id: "3b7be6c5-1861-57d2-a9ab-5770c3ea544d" ``` Publish the posture vector. **Rewritten against draft-7**, which landed after this task was written and moved the target: Decision 5.4 fixes the location at @@ -321,7 +321,7 @@ Two additions draft-7 forced that the original task did not anticipate: id: AUDIT-WP-0008-T02 status: done priority: high -state_hub_task_id: "224a12c0-d646-4c7f-9215-120e1ede4691" +state_hub_task_id: "3cf1d80f-4f35-5711-aa0a-aeb27912e2f6" ``` Reply to `rapp-postgres` message `56b77e20-0152-4e09-8f76-99640269063b`. **Runs first.** Carries four things: the retention position (ceiling stays 365, @@ -339,7 +339,7 @@ does not wait on T01. Mark the message read on send. id: AUDIT-WP-0008-T03 status: done priority: high -state_hub_task_id: "0003954e-5033-457f-b9aa-97efdefe9beb" +state_hub_task_id: "3c495a5c-6b0d-5fae-b237-626d298e7b2c" ``` Answer question 11 in `docs/erasure-and-audit.md`. @@ -363,7 +363,7 @@ publishable with the dependency hidden. id: AUDIT-WP-0008-T04 status: done priority: high -state_hub_task_id: "e4440db3-6eb0-49f6-9aa9-930db8be9d18" +state_hub_task_id: "ab07af53-0ca8-5d8e-b699-128d462e30a2" ``` Bind the read path to permitted tenants. `permits_tenant` governs read as it governs write, at the same choke point: tenant-scope `/v1/events`, @@ -376,7 +376,7 @@ and the operator runbook. Raises E to 2 on both paths; update T01's declaration. id: AUDIT-WP-0008-T05 status: done priority: medium -state_hub_task_id: "30b56b30-e7eb-4873-aa7c-f4a3bf2fcb24" +state_hub_task_id: "76d3b34e-df74-5af0-8025-e77e8644d199" ``` Produce the §13 E2 evidence artifact — adversarial, with a review date: an identity bound to tenant A demonstrably cannot read tenant B. Coordinate with @@ -531,7 +531,7 @@ in another manual T05 sequence. id: AUDIT-WP-0008-T06 status: done priority: medium -state_hub_task_id: "ed58ca37-755b-4284-b1ac-2a02baaceb21" +state_hub_task_id: "c0b6e317-bfde-5ba7-b92a-6545257e0dff" ``` Close the review loop with `net-kingdom`. @@ -550,7 +550,7 @@ duty, so the correction is ours to send unprompted or it will simply sit stale. id: AUDIT-WP-0008-T07 status: progress priority: high -state_hub_task_id: "e972a8f7-e6ee-4522-bc76-fb69d71e5ed5" +state_hub_task_id: "4e3ab790-daa6-5fbb-837e-9a9a26848201" ``` Reach **V1** on the availability axis, new in draft-8. @@ -643,7 +643,7 @@ environment-dependent skips. id: AUDIT-WP-0008-T08 status: done priority: high -state_hub_task_id: "50eed5e2-06d6-4bdc-913d-5a8cd41ce613" +state_hub_task_id: "f9d4ec51-6092-5c05-82fb-30e5dd201229" ``` Disclose the shared-substrate retention coupling in our **provider** block, and notify `user-engine` under Decision 6.1.