AUDIT-WP-0010 T01/T03/T04 — admit tenant-engine, and the envelope does not match

Registration: attributive, with the declared completeness_trade recorded on the
receiver side rather than only in the emitter, per §9.6's requirement that the
trade travel with the trail. tenants ["*"] is justified rather than inherited —
tenant-engine's events carry the affected tenant, the set is every tenant
including ones created later, and an explicit list would fail closed at exactly
the moment a tenant is provisioned, dead-lettering the creation evidence of the
tenant whose creation it is. source stays pinned exactly. Ingress ANDs namespace
and pod label; a weaker evidence class is not a reason for a wider network rule.
All inert until the token exists.

Then the finding T04 existed to find: tenant-engine cannot deliver a single
event today. envelope_for sends five required fields under other names —
event_id, action, resource, observed_at, details — and omits correlation_id
entirely, so normalize() raises invalid_event. Verified by running the real
envelope through the real function, not by reading.

Worse than an ordinary integration bug. The drain treats 400 as terminal, so the
outbox row is marked handled while audit-core holds only a dead letter, which is
not chained and is not custody. Lost on both sides, and since the drain is
non-blocking and attributive, nothing fails loudly — a silent total loss of the
stream presenting as a working integration.

Taking the correction the intake invited rather than accepting a lossy record.
normalize() is NOT relaxed to accept the alternate spellings: a receiver that
guesses which sender key means which stored field has made the mapping its own,
and the record stops being the sender's assertion. correlation_id cannot be
synthesized at all — an invented one ties an event to an operation audit-core
never observed.

Root cause is ours. The accepted envelope was published nowhere a sender could
read it; audit-backend-contract.md describes the stored record, and a sender
reading it would reasonably infer exactly the names tenant-engine used.
schema_version audit-core.event.v1alpha1 selects nothing here and gave a false
impression of a negotiated contract. Published docs/event-envelope.md as the
wire contract, including the point that a 400 means the event is not in the
archive and must be treated as a defect to fix rather than a delivery outcome.

T05 moved to wait: nothing to prove end to end until an event can be accepted.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nb7Q6ZmXppNDkTWytfYqfv

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2069992@bnt-lap001
Assistant-Session: 167dd7f8-2a25-4be1-aa46-3b6f1a5f94c6

tests/test_networkpolicies.py

@@ -97,3 +97,41 @@ def test_no_egress_to_informed_decision_is_created():
     assert "approval-engine" not in egress
     # Postgres and DNS only.
     assert egress.count("        - namespaceSelector:") == 2
+
+
+def test_tenant_engine_ingress_is_bound_to_namespace_and_pod_labels():
+    """AUDIT-WP-0010-T03. Attributive is a weaker claim, not a wider rule."""
+    documents = (ROOT / "deploy" / "networkpolicies.yaml").read_text().split("\n---\n")
+    policy = next(
+        document
+        for document in documents
+        if "name: audit-core-tenant-engine-ingress" in document
+    )
+    expected_peer = """        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: tenant-engine
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: tenant-engine"""
+    assert expected_peer in policy
+    assert policy.count("        - namespaceSelector:") == 1
+
+
+def test_every_sender_has_exactly_one_ingress_rule():
+    """A fourth sender fails here rather than silently in production.
+
+    AUDIT-WP-0010-T03 asked for this: the policy set and the registered sender
+    set must move together, and neither should be able to grow alone.
+    """
+    import json
+
+    text = (ROOT / "deploy" / "networkpolicies.yaml").read_text()
+    scope = json.loads((ROOT / "deploy" / "senders-scope.json").read_text())
+    senders = {entry["name"] for entry in scope}
+    assert senders == {
+        "user-engine", "approval-engine", "informed-decision", "tenant-engine"
+    }
+    # user-engine's rule predates the per-sender naming convention.
+    assert "name: audit-core-sender-ingress" in text
+    for sender in senders - {"user-engine"}:
+        assert f"name: audit-core-{sender}-ingress" in text

tests/test_senders.py

@@ -398,3 +398,55 @@ def test_a_load_bearing_source_cannot_be_given_a_completeness_trade():
             evidence_kind="load-bearing",
             completeness_trade="emits after commit",
         )
+
+
+# --- AUDIT-WP-0010: tenant-engine admission --------------------------------
+
+
+def test_tenant_engine_is_attributive_with_its_trade_declared():
+    scope = json.loads(SCOPE_FILE.read_text())
+    entry = next(e for e in scope if e["name"] == "tenant-engine")
+    assert entry["evidence_kind"] == "attributive"
+    assert entry["sources"] == ["tenant-engine"]
+    assert entry["may_read"] is False
+    # §9.6 permits the trade only where it is declared. Recorded on the
+    # receiver side, not only in the emitter's documentation.
+    assert "after commit" in entry["completeness_trade"]
+
+
+def test_tenant_engine_wildcard_tenant_does_not_widen_its_source():
+    """The wildcard is on tenants only; source stays pinned."""
+    registry = SenderRegistry.from_env({
+        "AUDIT_CORE_SENDERS": json.dumps([{
+            "name": "tenant-engine", "tokens": ["fixture-only"],
+            "sources": ["*"], "tenants": ["*"],
+        }]),
+        "AUDIT_CORE_SENDERS_SCOPE_PATH": str(SCOPE_FILE),
+    })
+    identity = registry.authenticate("Bearer fixture-only")
+    assert identity.permits_tenant("tenant:anything-created-later")
+    assert identity.permits_source("tenant-engine")
+    assert not identity.permits_source("user-engine")
+    assert not identity.permits_source("approval-engine")
+    assert identity.evidence_kind == "attributive"
+
+
+def test_an_overlay_cannot_lower_a_load_bearing_source_to_attributive():
+    """A ConfigMap refresh must not drop §9.6 obligations. Downgrading raises."""
+    with pytest.raises(ValueError, match="downgrade|lower"):
+        SenderRegistry.from_env({
+            "AUDIT_CORE_SENDERS": json.dumps([{
+                "name": "informed-decision", "tokens": ["fixture-only"],
+                "sources": ["informed-decision"], "evidence_kind": "load-bearing",
+            }]),
+            "AUDIT_CORE_SENDERS_SCOPE_PATH": str(_write_downgrade_overlay()),
+        })
+
+
+def _write_downgrade_overlay():
+    import tempfile
+    path = Path(tempfile.mkdtemp()) / "scope.json"
+    path.write_text(json.dumps(
+        [{"name": "informed-decision", "evidence_kind": "attributive"}]
+    ))
+    return path

tests/test_tenant_engine_envelope.py

@@ -0,0 +1,125 @@
+"""AUDIT-WP-0010-T04. The envelope tenant-engine actually sends.
+
+`AUDIT-IN-0002` invited a correction if the envelope needed a field the
+emitter does not send. It does — six of eight required fields, one of them
+absent entirely rather than merely renamed.
+
+These tests pin the mismatch rather than describing it, so that the day
+tenant-engine corrects `envelope_for` the failure here is the signal, and so
+that nobody quietly relaxes `normalize()` to accept the alternate spellings.
+"""
+
+import pytest
+
+from audit_core.ingestion import normalize
+from audit_core.senders import SenderIdentity
+
+
+IDENTITY = SenderIdentity(
+    name="tenant-engine",
+    tokens=("fixture-only",),
+    sources=frozenset({"tenant-engine"}),
+    evidence_kind="attributive",
+    completeness_trade="outbox drains after commit",
+)
+
+# Verbatim shape of tenant_engine.audit_core.envelope_for as of 2026-09-10.
+TENANT_ENGINE_ENVELOPE = {
+    "schema_version": "audit-core.event.v1alpha1",
+    "event_id": "e-1",
+    "observed_at": "2026-09-10T00:00:00+00:00",
+    "tenant": "tenant:acme",
+    "scope": "tenant-engine",
+    "source": "tenant-engine",
+    "actor": "u-1",
+    "action": "role.granted",
+    "resource": "tenant:acme",
+    "outcome": "recorded",
+    "reason": None,
+    "details": {"role": "admin"},
+}
+
+
+def test_the_tenant_engine_envelope_is_rejected_today():
+    """Not a hypothetical: this is the shape on the wire, and it 400s."""
+    with pytest.raises(ValueError, match="invalid_event"):
+        normalize(TENANT_ENGINE_ENVELOPE, "e-1", IDENTITY)
+
+
+@pytest.mark.parametrize(
+    "required,sent_as",
+    [
+        ("id", "event_id"),
+        ("type", "action"),
+        ("subject", "resource"),
+        ("occurred_at", "observed_at"),
+        ("data", "details"),
+    ],
+)
+def test_each_renamed_field_is_absent_under_the_name_the_receiver_reads(required, sent_as):
+    assert required not in TENANT_ENGINE_ENVELOPE
+    assert sent_as in TENANT_ENGINE_ENVELOPE
+
+
+def test_correlation_id_is_absent_entirely_and_cannot_be_synthesized():
+    """The one that is not a rename.
+
+    A receiver-invented correlation_id would tie an event to an operation
+    audit-core never observed, which is worse than not having one.
+    """
+    assert "correlation_id" not in TENANT_ENGINE_ENVELOPE
+    corrected = {
+        "id": TENANT_ENGINE_ENVELOPE["event_id"],
+        "type": TENANT_ENGINE_ENVELOPE["action"],
+        "source": TENANT_ENGINE_ENVELOPE["source"],
+        "subject": TENANT_ENGINE_ENVELOPE["resource"],
+        "tenant": TENANT_ENGINE_ENVELOPE["tenant"],
+        "occurred_at": TENANT_ENGINE_ENVELOPE["observed_at"],
+        "data": TENANT_ENGINE_ENVELOPE["details"],
+    }
+    with pytest.raises(ValueError, match="invalid_event"):
+        normalize(corrected, "e-1", IDENTITY)
+
+
+def test_the_corrected_envelope_is_accepted():
+    """What tenant-engine needs to send. The whole correction, in one place."""
+    corrected = {
+        "id": "e-1",
+        "type": "role.granted",
+        "source": "tenant-engine",
+        "subject": "tenant:acme",
+        "tenant": "tenant:acme",
+        "correlation_id": "req-9f21",
+        "occurred_at": "2026-09-10T00:00:00+00:00",
+        "data": {"role": "admin", "actor": "u-1"},
+    }
+    event = normalize(corrected, "e-1", IDENTITY)
+    assert event.event_id == "e-1"
+    assert event.action == "role.granted"
+    assert event.resource == "tenant:acme"
+    assert event.tenant == "tenant:acme"
+    assert event.details["data"]["role"] == "admin"
+    # Derived by the receiver, never taken from the sender.
+    assert event.outcome == "recorded"
+    assert event.actor is None
+    assert event.scope == "tenant"
+
+
+def test_normalize_still_refuses_the_alternate_spellings():
+    """Guards the decision not to relax the receiver.
+
+    Accepting event_id/action/resource as aliases would make audit-core choose
+    which sender key means which stored field. The mapping belongs to the
+    sender, which is the party whose assertion the record is.
+    """
+    required = ("id", "type", "source", "subject", "tenant", "correlation_id", "occurred_at", "data")
+    accepted = {
+        "id": "e-2", "type": "t", "source": "tenant-engine", "subject": "s",
+        "tenant": "tenant:acme", "correlation_id": "c",
+        "occurred_at": "2026-09-10T00:00:00+00:00", "data": {"k": "v"},
+    }
+    for field in required:
+        broken = dict(accepted)
+        broken.pop(field)
+        with pytest.raises(ValueError, match="invalid_event"):
+            normalize(broken, "e-2", IDENTITY)