coulomb/audit-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Assent to AUDIT-IN-0001 — approval evidence half, with conditions
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
gate-house proposed (security layer model v0.3 §9.4) that audit-core own
the tamper-evident record of approvals while approval-engine owns the
operative state. Assented, with two corrections and one condition.

Correction 1: INTENT principle 6 overstated the delivered guarantee.
docs/integrity.md is authoritative — an in-database chain does not
withstand a database owner without the external chain-head attestation,
and even then it is not WORM. Principle 6 now points at that bound.

Correction 2: the chain proves alteration and truncation, not omission
at source. A suppressed revocation leaves the chain intact.

Condition: approval-engine must guarantee emission atomicity, so an
approval cannot change state without the event being durably queued in
the same transaction. Not a task audit-core can discharge for it.

Boundary: no approval-validity query will be exposed — that would be
deciding early under §6.1.

Also declares audit-core's layer (Engine, not a decision point), which
§11 requires and INTENT.md was missing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpeL68AWHqtqPQZEXY5kFe

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4040362@bnt-lap001
Assistant-Session: 4fd0fd24-2ee8-4413-bd67-43bd79ca73f1
This commit is contained in:
tegwick 2026-08-28 22:46:13 +02:00
parent 2e2d9d54b5
commit 3177d2cee0
3 changed files with 205 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

25
intakes/intakes.md
View file

@ -7,7 +7,7 @@ id: AUDIT-IN-0001
kind: intake
title: 'Proposed: audit-core takes the approval evidence half (security layer model
v0.3 §9.4)'
status: open
status: closed
origin: cross-repo
origin_ref: net-kingdom security-layer-model_v0.3 §9.4
priority: medium
@ -30,5 +30,26 @@ description: 'gate-house proposes that audit-core own the tamper-evident record
approval events as a distinct source, say so and gate-house will record the evidence
half as unowned rather than assume it.'
created: '2026-08-28T20:35:09.148892Z'
updated: '2026-08-28T20:35:09.148892Z'
updated: '2026-08-28T21:10:00Z'
outcome: assent-with-conditions
closed: '2026-08-28T21:10:00Z'
resolution: 'Assent. The split is right: approval-engine owns the operative state,
audit-core owns the tamper-evident record of issuance, use, supersession, and
revocation as a distinct source. Two corrections to the rationale and one
condition. (1) INTENT principle 6 overstates the delivered guarantee;
docs/integrity.md is authoritative — an in-database chain does not withstand a
database owner without the external chain-head attestation, and even then it is
not WORM. Approval events get exactly the guarantee every other source gets,
no more; anything stronger is an engine gap to declare under §5.3. (2) The chain
proves alteration and truncation, not omission at source. A suppressed
revocation leaves the chain intact and verify reports intact; completeness at
the boundary is the emitter''s property, not the archive''s. CONDITION:
approval-engine must guarantee emission atomicity (transactional outbox or
equivalent) so an approval cannot change state without the event being durably
queued in the same transaction — a requirement on approval-engine, not a task
audit-core can discharge for it. Boundary stated: no approval-validity query
will ever be exposed; a verdict surface would be deciding early under §6.1.
Also raised: audit-core declared no layer, contrary to §11 — now declared Engine
layer, explicitly not a decision point.'
recorded_in: history/2026-08-28-approval-evidence-assent.md
```