coulomb/audit-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

repo.work.assign_missing_identifiers
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
source: repo-manager
reason: deterministic projection registration

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c
This commit is contained in:
repo-manager 2026-08-31 14:32:07 +02:00
parent 9dff75e59e
commit 95dcb78e17
1 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
workplans/AUDIT-WP-0010-tenant-engine-sender-admission.md
View file

@ -11,6 +11,7 @@ created: "2026-08-29"
updated: "2026-08-29"
depends_on:
- AUDIT-WP-0005
state_hub_workstream_id: "54655357-74da-5f7f-8fa6-647d4c969f21"
---
# AUDIT-WP-0010 — Admit tenant-engine as an attributive sender
@ -50,6 +51,7 @@ validated, not when events start arriving.
id: AUDIT-WP-0010-T01
status: todo
priority: high
state_hub_task_id: "e26170e3-78f1-5d98-bb8f-46cef32244bb"
```
Register the sender identity: name `tenant-engine`, `sources: [tenant-engine]`,
`may_write: true`, `may_read: false`, `secret_policy: redact`, tenants scoped as
@ -61,6 +63,7 @@ value in Git — projected only, per the established lane.
id: AUDIT-WP-0010-T02
status: todo
priority: high
state_hub_task_id: "13855bd9-4ff4-5e8c-ab98-d5ff45103d22"
```
Provide the token lane. Coordinate the projected credential with the owning
credential operator through the `ops-warden` route, matching the custody pattern
@ -71,6 +74,7 @@ transport a value through State Hub messages.
id: AUDIT-WP-0010-T03
status: todo
priority: high
state_hub_task_id: "1a75fba2-a625-5e87-bba9-e38f010856fc"
```
Extend the NetworkPolicy. `deploy/networkpolicies.yaml` currently admits
`user-engine`; add `tenant-engine`. `tests/test_networkpolicies.py` exists —
@ -81,6 +85,7 @@ third sender fails the test rather than silently failing in production.
id: AUDIT-WP-0010-T04
status: todo
priority: medium
state_hub_task_id: "56bde19e-6b54-5d9e-a3d7-8b13e810cb51"
```
Validate the envelope against what `tenant-engine` actually sends:
`schema_version: audit-core.event.v1alpha1`, `tenant` = affected `tenant_id`,
@ -98,6 +103,7 @@ so the §9.6 trade is documented here and not only in the emitter.
id: AUDIT-WP-0010-T05
status: todo
priority: medium
state_hub_task_id: "777bb728-4a4d-5c5b-8b62-24fdb6ab31e3"
```
Prove it end to end against the production receiver: a real event from
`tenant-engine` accepted, attributed to the right tenant, redacted per policy,