coulomb/audit-core
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore(consistency): write back State Hub ids
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details

Browse source 
Assistant: grok
Assistant-Session: 01a17f9d-fe9d-7d72-9a22-6304f1a2a790
This commit is contained in:
tegwick 2026-10-28 01:05:31 +01:00
parent 914e078659
commit 64c0fa5285
1 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
workplans/AUDIT-WP-0017-production-audit-sources-and-correlation.md
View file

@ -14,6 +14,7 @@ related:
- NK-WP-0055
- AUDIT-WP-0013
- AUDIT-WP-0015
state_hub_workstream_id: "bc6d12fa-c418-572e-a939-745d0906c111"
---
# AUDIT-WP-0017 — Production audit sources, correlation-id contract, restore drill and offsite chain head
@ -61,6 +62,7 @@ status: wait
priority: high
blocking_reason: "railiance-platform must supply a forwarder design for the OpenBao audit device (today audit only lands on a PVC) and the common intake package."
blocked_on: message-from:railiance-platform
state_hub_task_id: "c95315a8-f55e-5b8d-bed9-4be8c7cfc291"
```
Needs from railiance-platform: the forwarder (socket or file-tail device to the receiver), HMAC'd fields kept
@ -78,6 +80,7 @@ status: wait
priority: high
blocking_reason: "railiance-cluster must supply the k3s audit policy (levels and excluded noise) and a forwarding path (webhook backend or log shipper) plus the common intake package."
blocked_on: message-from:railiance-cluster
state_hub_task_id: "3a1912c5-d083-5f5a-995e-6cc2e3ee7bb6"
```
Needs from railiance-cluster: audit policy that records Secret access at Metadata level only (never
@ -94,6 +97,7 @@ priority: high
depends_on: [AUDIT-WP-0013-T02]
blocking_reason: "Tracked by AUDIT-WP-0013-T02; waits on flex-auth/access-engine registrations and attended custody."
blocked_on: message-from:access-engine
state_hub_task_id: "9dd5848b-0ef2-5eb0-a4b6-c0a142592025"
```
No separate admission here. This task closes when AUDIT-WP-0013-T02 is done and the decision records carry the
@ -107,6 +111,7 @@ status: wait
priority: high
blocking_reason: "NetKingdom must supply one intake package per provider (KeyCape, Authelia, LLDAP, privacyIDEA) and say which events are in scope."
blocked_on: message-from:net-kingdom
state_hub_task_id: "913e285d-93a8-5960-a560-d8e4c3924799"
```
Needs from NetKingdom: per provider, the event set (login success/failure, MFA enrolment and challenge, token
@ -121,6 +126,7 @@ names, not one merged stream, so silence in one provider is detectable.
id: AUDIT-WP-0017-T05
status: todo
priority: high
state_hub_task_id: "5346525c-ff4a-5312-b924-05cfac3a32cc"
```
The envelope already carries `correlation_id` (free-form string) and the receiver serves
@ -150,6 +156,7 @@ query returns the whole chain.
id: AUDIT-WP-0017-T06
status: todo
priority: high
state_hub_task_id: "32ad0631-5489-5ee2-a77c-60a1a348dcd7"
```
The only restore evidence is the 2026-08-13 walk. Define a recurring drill: quarterly, and after any schema or
@ -170,6 +177,7 @@ priority: high
depends_on: [AUDIT-WP-0015-T01]
blocking_reason: "AUDIT-WP-0015-T01 still waits on resource-control and rapp-postgres to name the chain-head custody owner and return offsite upload/readback receipts."
blocked_on: message-from:resource-control
state_hub_task_id: "6055df17-9fae-5cc9-bb89-b2ffdaf6f3fb"
```
Status 2026-10-27: AUDIT-WP-0015-T01 is `wait`. No owner or task for chain-head custody has been named and no