diff --git a/registry/capabilities/capability.audit.event-retain.md b/registry/capabilities/capability.audit.event-retain.md index a5055a5..3bb5ef6 100644 --- a/registry/capabilities/capability.audit.event-retain.md +++ b/registry/capabilities/capability.audit.event-retain.md @@ -1,16 +1,23 @@ --- id: capability.audit.event-retain -name: Audit Event Retention -summary: Collect, normalize, retain, and search audit events with integrity evidence across tenants. owner: audit-core -status: production +status: draft domain: infotech -tags: [audit, retention, compliance] -joins: - itc_cap: operations.audit - provision: data/capability/audit-core-operational.json - provision_maturity: D4 - +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A4 + target: A4 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Tenant-aware event ingestion, + chain integrity, heartbeat and reconciliation. Availability describes the delivery + form, not production acceptance. Custody after arrival does not prove source + completeness; freshness bounds integrity assertions.' external_evidence: completeness: level: C3 @@ -18,71 +25,91 @@ external_evidence: confidence: medium basis: live_receiver_and_restore_walk satisfied_expectations: - - HTTP ingest through the backend contract - - append-only Postgres custody on platform-pg - - recovery cited to the live platform data.backup provision + - HTTP ingest through the backend contract + - append-only Postgres custody on platform-pg + - recovery cited to the live platform data.backup provision broken_expectations: - - data.archive sink not provided + - data.archive sink not provided out_of_scope_expectations: - - application business audit semantics ownership - - booked-cost origination + - application business audit semantics ownership + - booked-cost origination reliability: level: R2 confidence: medium basis: failure_matrix_and_restore_walk known_reliability_risks: - - single replica - + - single replica +name: Independent audit custody +summary: Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation. +tags: +- security +- netkingdom +- framework-reuse discovery: - intent: > - Provide independent audit fabric for collecting, retaining, searching, and - proving integrity of audit events. + intent: Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation includes: - - audit ingestion - - retention policy - - search and export - - tamper evidence + - Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation excludes: - - generating domain business events - - procuring or operating platform backup - - booked financial facts - use_cases: [] - + - Custody after arrival does not prove source completeness; freshness bounds integrity + assertions + use_cases: + - 'U08: Consumer emits security events and reconciles independently retained evidence' + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' + - 'U10: Operator recovers identity, custody or data with independently held recovery + material' availability: current_level: A4 - target_level: A5 + target_level: A4 current_artifacts: - - audit-core/deploy/audit-core.yaml - - audit-core/audit_core/postgres_backend.py - - rapp-postgres/consumers/audit-core.yaml + - SCOPE.md + - docs/stream-completeness.md consumption_modes: - - http ingest - - source module - + - HTTP API + - source relations: - depends_on: [] related_to: - - capability.activity.event-coordinate - - capability.statehub.progress-log - uses_provisions: - - data.transactional (rapp-postgres/platform-pg) - - data.backup (resource:platform:audit-storage, cited) - - security.secrets (OpenBao / ESO) - + - capability.security.approval-lifecycle + - capability.identity.tenant-facts + - capability.security.posture-assessment + - capability.observability.security-signals +evidence: + documentation: + - SCOPE.md + - docs/stream-completeness.md consumer_guidance: recommended_for: - - platform and application audit event delivery over POST /v1/events + - Consumer emits security events and reconciles independently retained evidence + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + - Operator recovers identity, custody or data with independently held recovery material not_recommended_for: - - treating this store as WORM archive - - replacing application-level logging only + - Custody after arrival does not prove source completeness; freshness bounds integrity + assertions known_limitations: - - recoverable history is the 30-day platform backup window - - no hash-chain or export API yet + - Custody after arrival does not prove source completeness; freshness bounds integrity + assertions + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. --- -# Audit Event Retention +# Independent audit custody -Audit Core provides the operational custody layer for audit events. -ITC-CAP join: `operations.audit` at provision maturity D4 -(`data/capability/audit-core-operational.json`). Maturity is not a -property of this abstract capability. +Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation. + +## Reuse boundary + +Custody after arrival does not prove source completeness; freshness bounds integrity assertions. + +## Supported use cases + +- U08: Consumer emits security events and reconciles independently retained evidence +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes +- U10: Operator recovers identity, custody or data with independently held recovery material + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [docs/stream-completeness.md](../../docs/stream-completeness.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/registry/indexes/capabilities.yaml b/registry/indexes/capabilities.yaml index 573e997..6248a85 100644 --- a/registry/indexes/capabilities.yaml +++ b/registry/indexes/capabilities.yaml @@ -1,22 +1,19 @@ version: 1 -updated: '2026-08-16' +updated: '2026-10-14' domain: infotech capabilities: - id: capability.audit.event-retain - name: Audit Event Retention - summary: Collect, normalize, retain, and search audit events with integrity evidence - across tenants. - joins: operations.audit - provision: data/capability/audit-core-operational.json - vector: D4 provision / A4 / C3 / R2 + name: Independent audit custody + summary: Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation. domain: infotech - status: production + status: draft owner: audit-core - path: registry/capabilities/capability.audit.event-retain.md tags: - - audit - - retention - - compliance + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C3 / R2 + path: registry/capabilities/capability.audit.event-retain.md consumption_modes: - - http ingest - - source module + - HTTP API + - source