coulomb/audit-core
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Register informed-decision.memo.posed for the platform tenant.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Accept the retained pose envelope and refuse packet, brief, and secret
content. Heartbeat and reconciliation follow the existing load-bearing
class pattern. This does not connect the sink or claim runtime readiness.

Assistant: grok
Assistant-Session: 01a10329-31cb-78d3-b7a3-787a69c89d54
This commit is contained in:
tegwick 2026-10-03 21:18:13 +02:00
parent fdca5758e1
commit 70e4044128
16 changed files with 534 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/event-envelope.md
View file

@ -79,7 +79,7 @@ as the sender's claim rather than the archive's.
| --- | --- |
| `202` | Accepted and stored |
| `200` | Duplicate `id` — already stored, reconciled rather than re-linked. Not an error; do not retry |
| `400` | Rejected and **dead-lettered**. Body carries the reason: `invalid_event`, `idempotency_key_mismatch`, `source_not_allowed`, `tenant_not_allowed`, `secret_shaped_field` |
| `400` | Rejected and **dead-lettered**. Body carries the reason: `invalid_event`, `idempotency_key_mismatch`, `source_not_allowed`, `tenant_not_allowed`, `secret_shaped_field`, `content_refused` |
| `401` | Unknown or expired token |
| `403` | The credential lacks `may_write` |

44
docs/informed-decision-source-registration.md
View file

@ -213,3 +213,47 @@ receiver source/tenant/read refusal, independent readback and audit bearer
revocation. No native producer event or operational heartbeat is claimed by
the custody receipt. Attestation/offsite operation remains a separate evidence
quality bound in AUDIT-WP-0009-T12.
## Event class `informed-decision.memo.posed` — 2026-10-03
`AUDIT-WP-0011`. Intake dependency T07. Same sender, same source, same
`tenant:platform` scope. Not a new credential, not a new custody class, and
not a change to `evidence_kind`, `secret_policy`, or `completeness_trade`.
The accepted body is the envelope informed-decision already retains for the
posed job. `data` is exactly these fields, each a non-empty string:
| Field | What it is |
| --- | --- |
| `memo_id` | memo id |
| `approval_id` | approval id |
| `approval_binding_digest` | carried binding digest |
| `submitter` | authenticated forwarding submitter |
| `memo_class` | memo class |
| `submission_digest` | submission digest |
`source` must be `informed-decision` and `tenant` must be `tenant:platform`.
The bare tenant string `platform` is not registered. No other `data` key is
part of this registration.
Packet and brief keys are `content_refused`. Secret-shaped keys (the existing
name scan: password, secret, token, credential, private_key) are
`secret_shaped_field` for this class even though the sender's policy remains
`redact` for every other class. Both refusals withhold the payload from the
dead-letter store. This receiver still does not verify the digest, read the
memo, or decide whether the approval is valid.
Idempotency is the existing receipt: `Idempotency-Key` must equal `id`; `202`
`accepted` with `reference` `audit:<id>`; an exact replay is `200`
`duplicate` with the same reference.
The class is load-bearing and low-volume, so it uses the existing
heartbeat-or-reconciliation requirement rather than a rate. `heartbeat_classes`
on this registration is `informed-decision.memo.posed` at 86400 seconds — the
interval this sender already publishes for its other low-volume classes and
the interval the approval-engine registration tests use. Reconciliation is
`GET /v1/reconciliation` for source `informed-decision` and tenant
`tenant:platform`, counts only. Neither control is claimed to be operating,
and this registration does not make the receiver runtime-ready for the posed
job. Connecting `AuditCoreSink` stays informed-decision's step, after this
contract.