AUDIT-WP-0009-T03/T09 — evidence_kind, and approval-engine's registration inputs

T03. §9.6 gives load-bearing and attributive sources different obligations, so
the archive must record which one a source declared rather than infer it from
traffic. evidence_kind and completeness_trade now sit on SenderIdentity, the
AUDIT_CORE_SENDERS schema, and the non-secret scope overlay.

Two asymmetries are deliberate. The default is attributive, because the other
default would have audit-core imply a completeness obligation no source ever
accepted. And the overlay may raise the kind but never lower it — the same
principle that stops an ExternalSecret refresh shrinking user-engine's
tenants: a ConfigMap refresh must not drop a source's atomicity and detection
obligations without anyone deciding to. A load-bearing source may not carry a
completeness trade at all, since §9.6 requires atomicity of it, and
evidence_declaration() reports completeness_claimed: false for both kinds.

T09 (in progress). approval-engine's registration inputs are prepared and
recorded in docs/approval-engine-source-registration.md: scope entry declared
load-bearing, and audit-core-approval-engine-ingress with namespace and pod
label ANDed in one `from` peer — narrower than user-engine's namespace-only
rule, which is left unchanged. The scope entry lands ahead of the credential
because the overlay only applies to senders the Secret already carries, so it
admits nothing until the token exists; a test asserts that rather than
trusting the reading.

Two inputs remain approval-engine's: a confirmed tenant scope, since senders.py
requires a missing tenant restriction be justified per sender and audit-core
cannot justify it on another repo's behalf, and an explicit secret_policy
choice. Applying the manifests is an operator action.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0185wifnLzCxjEY2MT1XbK7L

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 713962@bnt-lap001
Assistant-Session: 2718d99d-d3ff-478f-83a2-3a30f01a02fc

tests/test_networkpolicies.py

@@ -24,3 +24,38 @@ def test_whitehat_ingress_is_bound_to_namespace_and_target_labels():
     assert expected_peer in policy
     assert policy.count("        - namespaceSelector:") == 1
     assert "        - {protocol: TCP, port: 8080}" in policy
+
+
+def test_approval_engine_ingress_is_bound_to_namespace_and_pod_labels():
+    """AUDIT-WP-0009-T09. A load-bearing source gets a narrow rule, not a wide one."""
+    documents = (ROOT / "deploy" / "networkpolicies.yaml").read_text().split("\n---\n")
+    policy = next(
+        document
+        for document in documents
+        if "name: audit-core-approval-engine-ingress" in document
+    )
+
+    # One `from` peer holding both selectors. Two list items would be OR, and
+    # would admit every pod in the approval-engine namespace plus every pod
+    # anywhere carrying the app label.
+    expected_peer = """        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: approval-engine
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: approval-engine"""
+    assert expected_peer in policy
+    assert policy.count("        - namespaceSelector:") == 1
+    assert "        - {protocol: TCP, port: 8080}" in policy
+
+
+def test_user_engine_sender_ingress_is_unchanged_by_the_new_sender():
+    """glas-harness asked for user-engine's sender to stay as it is."""
+    documents = (ROOT / "deploy" / "networkpolicies.yaml").read_text().split("\n---\n")
+    policy = next(
+        document
+        for document in documents
+        if "name: audit-core-sender-ingress" in document
+    )
+    assert "kubernetes.io/metadata.name: user-engine" in policy
+    assert "approval-engine" not in policy

tests/test_senders.py

@@ -4,7 +4,7 @@ from pathlib import Path
 
 import pytest
 
-from audit_core.senders import SenderRegistry, WILDCARD
+from audit_core.senders import SenderIdentity, SenderRegistry, WILDCARD
 
 ROOT = Path(__file__).resolve().parents[1]
 SCOPE_FILE = ROOT / "deploy" / "senders-scope.json"
@@ -158,3 +158,164 @@ def test_invalid_scope_overlay_is_a_startup_error():
         SenderRegistry.from_env(
             {"AUDIT_CORE_SENDERS": secret, "AUDIT_CORE_SENDERS_SCOPE": "{}"}
         )
+
+
+# --- AUDIT-WP-0009-T03: §9.6 evidence kind ---------------------------------
+
+
+def test_evidence_kind_defaults_to_attributive():
+    """A source that has not declared must not be treated as load-bearing.
+
+    The other default would have audit-core imply a completeness obligation no
+    source ever accepted.
+    """
+    identity = SenderIdentity(
+        name="quiet", tokens=("t",), sources=frozenset({"quiet"})
+    )
+    assert identity.evidence_kind == "attributive"
+    assert identity.is_load_bearing is False
+
+
+def test_load_bearing_is_an_explicit_declaration():
+    identity = SenderIdentity(
+        name="approval-engine",
+        tokens=("t",),
+        sources=frozenset({"approval-engine"}),
+        evidence_kind="load-bearing",
+    )
+    assert identity.is_load_bearing is True
+
+
+def test_unknown_evidence_kind_is_refused():
+    with pytest.raises(ValueError, match="evidence_kind must be one of"):
+        SenderIdentity(
+            name="x", tokens=("t",), sources=frozenset({"x"}), evidence_kind="best-effort"
+        )
+
+
+def test_attributive_source_carries_its_declared_trade():
+    identity = SenderIdentity(
+        name="tenant-engine",
+        tokens=("t",),
+        sources=frozenset({"tenant-engine"}),
+        completeness_trade="drain is non-blocking; emission is after commit",
+    )
+    declaration = identity.evidence_declaration()
+    assert declaration["completeness_trade"].startswith("drain is non-blocking")
+    # Neither kind licenses a completeness claim (§9.6).
+    assert declaration["completeness_claimed"] is False
+
+
+def test_load_bearing_source_may_not_declare_a_trade():
+    """§9.6 requires atomicity of it, so there is no trade to record."""
+    with pytest.raises(ValueError, match="may not declare a completeness_trade"):
+        SenderIdentity(
+            name="approval-engine",
+            tokens=("t",),
+            sources=frozenset({"approval-engine"}),
+            evidence_kind="load-bearing",
+            completeness_trade="emits after commit",
+        )
+
+
+def test_blank_trade_is_refused_rather_than_stored():
+    with pytest.raises(ValueError, match="completeness_trade must say what"):
+        SenderIdentity(
+            name="x", tokens=("t",), sources=frozenset({"x"}), completeness_trade="   "
+        )
+
+
+def test_registration_schema_carries_evidence_kind():
+    registry = SenderRegistry.from_env({
+        "AUDIT_CORE_SENDERS": json.dumps([
+            {
+                "name": "approval-engine",
+                "tokens": ["tok"],
+                "sources": ["approval-engine"],
+                "tenants": ["*"],
+                "evidence_kind": "load-bearing",
+            },
+            {
+                "name": "tenant-engine",
+                "tokens": ["tok2"],
+                "sources": ["tenant-engine"],
+                "tenants": ["*"],
+                "completeness_trade": "non-blocking drain",
+            },
+        ])
+    })
+    by_name = {i.name: i for i in registry.identities}
+    assert by_name["approval-engine"].is_load_bearing is True
+    assert by_name["tenant-engine"].is_load_bearing is False
+    assert by_name["tenant-engine"].completeness_trade == "non-blocking drain"
+
+
+def test_scope_overlay_may_raise_the_evidence_kind():
+    registry = SenderRegistry.from_env({
+        "AUDIT_CORE_SENDERS": json.dumps(
+            [{"name": "approval-engine", "tokens": ["tok"], "sources": ["approval-engine"]}]
+        ),
+        "AUDIT_CORE_SENDERS_SCOPE": json.dumps(
+            [{"name": "approval-engine", "evidence_kind": "load-bearing"}]
+        ),
+    })
+    assert registry.identities[0].is_load_bearing is True
+
+
+def test_scope_overlay_may_not_downgrade_a_load_bearing_source():
+    """A ConfigMap refresh must not quietly drop atomicity obligations."""
+    with pytest.raises(ValueError, match="may not downgrade"):
+        SenderRegistry.from_env({
+            "AUDIT_CORE_SENDERS": json.dumps([{
+                "name": "approval-engine",
+                "tokens": ["tok"],
+                "sources": ["approval-engine"],
+                "evidence_kind": "load-bearing",
+            }]),
+            "AUDIT_CORE_SENDERS_SCOPE": json.dumps(
+                [{"name": "approval-engine", "evidence_kind": "attributive"}]
+            ),
+        })
+
+
+# --- AUDIT-WP-0009-T09: approval-engine registration inputs ----------------
+
+SCOPE_CONFIGMAP = ROOT / "deploy" / "senders-scope.yaml"
+
+
+def test_declared_scope_and_configmap_stay_in_lockstep():
+    """The header says to keep them in lockstep; nothing asserted it."""
+    yaml = pytest.importorskip("yaml")
+    embedded = yaml.safe_load(SCOPE_CONFIGMAP.read_text())["data"]["senders-scope.json"]
+    assert json.loads(embedded) == json.loads(SCOPE_FILE.read_text())
+
+
+def test_approval_engine_is_declared_load_bearing():
+    scope = json.loads(SCOPE_FILE.read_text())
+    entry = next(e for e in scope if e["name"] == "approval-engine")
+    assert entry["evidence_kind"] == "load-bearing"
+    assert entry["sources"] == ["approval-engine"]
+    # A source does not gain a read surface by emitting.
+    assert entry["may_read"] is False
+    # §9.6 permits no completeness trade for a load-bearing source.
+    assert "completeness_trade" not in entry
+    assert "tokens" not in entry and "token" not in entry
+
+
+def test_a_scope_entry_without_a_token_admits_nothing():
+    """What makes it safe to land approval-engine's scope ahead of its credential."""
+    registry = SenderRegistry.from_env({
+        "AUDIT_CORE_SENDERS": json.dumps(
+            [{"name": "user-engine", "tokens": ["live"], "sources": ["user-engine"]}]
+        ),
+        "AUDIT_CORE_SENDERS_SCOPE_PATH": str(SCOPE_FILE),
+    })
+    assert [i.name for i in registry.identities] == ["user-engine"]
+    assert registry.authenticate("Bearer live").name == "user-engine"
+
+
+def test_user_engine_evidence_kind_is_not_asserted_on_its_behalf():
+    """Undeclared means attributive by default, not a claim audit-core made."""
+    scope = json.loads(SCOPE_FILE.read_text())
+    entry = next(e for e in scope if e["name"] == "user-engine")
+    assert "evidence_kind" not in entry