coulomb/audit-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(admission): restrict approval audit sender to the platform tenant
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-08 17:01:41 +02:00
parent 633f68b81b
commit bbe8c15494
5 changed files with 46 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

9
workplans/AUDIT-WP-0009-evidence-role-conformance.md
View file

@ -264,6 +264,15 @@ approvals is omission, which tamper evidence does not address at all. T04 does.
A consumer waiting on T02 before trusting approval evidence would be waiting on
the wrong thing.
**2026-09-08 source return:** approval-engine now records the exact existing
store scope `["tenant:platform"]` and explicitly selects `redact` in
`docs/audit-source-registration.md`. This supersedes the two input waits above.
The JSON and ConfigMap overlays are narrowed together. The overlay preserves
secret_policy from the protected registry, so provisioning must set it there.
T09 remains progress for the platform custody record, credential, admitted
manifest application and positive/negative live ingestion evidence. No secret
was created and no production manifest was applied by this source change.
```task
id: AUDIT-WP-0009-T10
status: todo