coulomb/audit-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

AUDIT-WP-0009-T01 — derive tamper_evidence from live attestation state

Browse source 
The Postgres backend returned tamper_evidence=True as a constant while
docs/integrity.md permits the claim only when a live external chain-head
attestation exists. The one attestation on record is 2026-08-16 and no job
renews it, so audit-core was telling every sender it had a property whose
precondition was unverified — the §9.6 defect it twice corrected in
gate-house's doctrine, turned inward.

evaluate_tamper_evidence() derives the flag from the chain report and the
mounted attestation, distinguishing seven states. Absence, staleness,
mismatch, an undated or unreadable attestation, a chain break, and an
unwalkable chain all degrade the claim rather than leave it standing.
Unreadable is treated as absent on purpose: a malformed file must not hold
up a claim a missing file would drop.

The freshness window is 168h against an intended daily cadence — seven
cadences, so a handful of missed runs degrade the claim rather than a single
one flapping it. Window and cadence are one contract in docs/integrity.md.

Production /readyz will now report tamper_evidence: false until
AUDIT-WP-0009-T02 schedules attestation. The claim was already false; it now
says so.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0185wifnLzCxjEY2MT1XbK7L

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 713962@bnt-lap001
Assistant-Session: 2718d99d-d3ff-478f-83a2-3a30f01a02fc
This commit is contained in:
tegwick 2026-09-06 20:34:22 +02:00
parent 95dcb78e17
commit 2f7f475e85
7 changed files with 408 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

20
workplans/AUDIT-WP-0009-evidence-role-conformance.md
View file

@ -57,7 +57,7 @@ Fixed by the statute; not deferred, not ours:
```task
id: AUDIT-WP-0009-T01
status: todo
status: done
priority: high
state_hub_task_id: "f545b0e4-8c99-5186-affd-ce9a41209ed7"
```
@ -69,6 +69,24 @@ leave it standing. Assert the degradation with a test, and state the freshness
window in `docs/integrity.md` alongside the two existing preconditions, which
today are documented but unenforced.
Done 2026-09-06. `evaluate_tamper_evidence` in `audit_core/integrity.py` derives
the claim from a `ChainReport` and the mounted attestation; `PostgresAuditBackend`
reads it per `retention_policy` call through `tamper_evidence_state()`, briefly
cached because `/readyz` probes it. Seven degradation reasons are distinguished
and asserted — `no_attestation`, `attestation_stale`, `attestation_mismatch`,
`attestation_undated`, `chain_break`, `chain_unreadable`, against `attested`.
Unreadable is treated as absent deliberately: a malformed file must not hold up
a claim a missing file would drop. The freshness window is **168h** against an
intended daily cadence, declared in `docs/integrity.md` with the reasoning that
the window is seven cadences so missed runs degrade rather than flap. Twelve
tests in `tests/test_integrity.py`; `docs/audit-backend-contract.md` now states
the field is derived rather than declared.
Consequence to state plainly: production `/readyz` will report
`tamper_evidence: false` until T02 mounts a renewed attestation. The 2026-08-16
attestation is 21 days old against a 7-day window. That is the overclaim being
removed, not a regression — the claim was false before and now says so.
```task
id: AUDIT-WP-0009-T02
status: todo