coulomb/audit-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

AUDIT-WP-0009-T01 — derive tamper_evidence from live attestation state

Browse source 
The Postgres backend returned tamper_evidence=True as a constant while
docs/integrity.md permits the claim only when a live external chain-head
attestation exists. The one attestation on record is 2026-08-16 and no job
renews it, so audit-core was telling every sender it had a property whose
precondition was unverified — the §9.6 defect it twice corrected in
gate-house's doctrine, turned inward.

evaluate_tamper_evidence() derives the flag from the chain report and the
mounted attestation, distinguishing seven states. Absence, staleness,
mismatch, an undated or unreadable attestation, a chain break, and an
unwalkable chain all degrade the claim rather than leave it standing.
Unreadable is treated as absent on purpose: a malformed file must not hold
up a claim a missing file would drop.

The freshness window is 168h against an intended daily cadence — seven
cadences, so a handful of missed runs degrade the claim rather than a single
one flapping it. Window and cadence are one contract in docs/integrity.md.

Production /readyz will now report tamper_evidence: false until
AUDIT-WP-0009-T02 schedules attestation. The claim was already false; it now
says so.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0185wifnLzCxjEY2MT1XbK7L

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 713962@bnt-lap001
Assistant-Session: 2718d99d-d3ff-478f-83a2-3a30f01a02fc
This commit is contained in:
tegwick 2026-09-06 20:34:22 +02:00
parent 95dcb78e17
commit 2f7f475e85
7 changed files with 408 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

10
SCOPE.md
View file

@ -97,10 +97,12 @@ effect of its own.
**Known conformance gaps** (assessed 2026-08-29,
`history/2026-08-29-v0.7-alignment-and-scope-assessment.md`):
- `tamper_evidence=True` is returned unconditionally by the Postgres backend
while `docs/integrity.md` permits it only when a live external attestation
exists. The one attestation on record is 2026-08-16 and no job renews it.
This is Audit Core overclaiming its own bound — the §9.6 defect turned inward.
- ~~`tamper_evidence=True` returned unconditionally by the Postgres backend~~
**Closed 2026-09-06 (`AUDIT-WP-0009-T01`).** The flag is now derived per
read from live chain and attestation state against a declared 168h
freshness window. Until `AUDIT-WP-0009-T02` schedules attestation, the
honest answer in production is `false` — the overclaim is gone, the
precondition is not yet met.
- No cadence, heartbeat, reconciliation, or load-bearing classification exists.
The §9.6 obligations Audit Core argued for are not yet supportable by Audit
Core.