coulomb/audit-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

AUDIT-WP-0009-T11 — register informed-decision, and answer GH-DEC-2026-014
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
informed-decision is the browser-facing approver surface; GH-DEC-2026-012
limit 3 makes its evidence copy the one that must reach audit-core
independently of the emitter, because there the actor being audited and the
evidence source are the same component.

Registration accepted on every proposed field — exact source,
["tenant:platform"], write true, read false, load-bearing, secret_policy
redact. Prepared and inert: the scope overlay applies only to a sender the
Secret already carries, asserted by test rather than by reading. Ingress ANDs
namespace and pod label in one peer, following approval-engine rather than
user-engine's older breadth.

Gate House asked whether the record shape can carry a source-held-content
declaration with a retrieval expectation, and asked for a straight answer
rather than a rule the storage cannot meet. Both halves, which must travel
together:

  It CAN carry the declaration. data is stored verbatim into details.data and
  hash-chained, so content_exists and custody need no schema change and become
  as tamper-evident as the commitment they accompany.

  It CANNOT detect non-production. audit-core performs no retrieval and its
  egress permits Postgres and DNS only. Detection happens at retrieval, by the
  reviewer; the stored declaration is what turns a blank into a failure
  attributable to the named custodian.

Residual stated rather than left to be found: a custodian that never held the
content can emit a false content_exists. audit-core validates the declaration's
shape, never its truth — the same class as omission at source, and not closed
by the chain, by attestation, or by T04/T06. A test asserts no egress to the
emitter exists, because that claim silently stops being true if one appears.

Cadence: reconciliation plus heartbeat is right for a mixed-volume source, with
both scoped per class rather than per source — a per-source heartbeat is
satisfied by the high-volume presentation stream and says nothing about a quiet
month of dispositions. Bound: a compromised emitter suppresses the event and
its own count together.

Also recorded: commitment-only satisfies non-alteration and never
reconstructability, in this repo's documents as in theirs; and tenant
provenance under GH-DEC-2026-013 lands in the registration record, not the
envelope, since audit-core checks a value the credential may write rather than
resolving an identity claim.

No secret was created and no production manifest applied.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nb7Q6ZmXppNDkTWytfYqfv

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2069992@bnt-lap001
Assistant-Session: 167dd7f8-2a25-4be1-aa46-3b6f1a5f94c6
This commit is contained in:
tegwick 2026-09-10 15:15:35 +02:00
parent 565e7e38d4
commit c4016a70d5
8 changed files with 486 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

69
intakes/intakes.md
View file

@ -1,5 +1,74 @@
# Intake records
## AUDIT-IN-0003 — Register informed-decision as a load-bearing sender; commitment-only payload doctrine
```yaml
id: AUDIT-IN-0003
kind: intake
title: 'Register informed-decision as a load-bearing sender, and answer GH-DEC-2026-014
limit 3'
status: closed
origin: cross-repo
origin_ref: INFD-WP-0001-T08 / GH-DEC-2026-012 / GH-DEC-2026-014
priority: high
owner: audit-core
requested_by: informed-decision
description: >
informed-decision is the browser-facing approver surface approval-engine
deliberately does not contain, ruled PEP-shaped by GH-DEC-2026-012. Limit 3
of that ruling requires its evidence copy to reach audit-core independently
of the emitter, because the actor being audited and the evidence source are
the same component.
Requested: (1) sender registration — source informed-decision exact, tenants
[tenant:platform], write true, read false, evidence_kind load-bearing,
secret_policy redact; (2) whether reconciliation per class as primary plus
heartbeat for the low-volume classes is the right cadence form for a
mixed-volume source; (3) whether commitment-only content is one event class
or two, and whether it belongs in the same class as other evidence.
GH-DEC-2026-014 attached a condition addressed to audit-core: non-production
of committed content must be detectable as a FINDING rather than present as
an absence, so the record must carry an assertion that committed content
exists and where custody sits. Gate House asked audit-core to say plainly
whether the record shape can express that, rather than have a rule written
that the storage cannot meet.
created: '2026-09-09'
updated: '2026-09-10'
outcome: registered-with-a-stated-bound
closed: '2026-09-10'
resolution: 'Registration accepted on every proposed field; the proposal was
correct and the substance is in the bounds. Prepared and inert pending token,
protected-registry entry and operator apply —
docs/informed-decision-source-registration.md, deploy/senders-scope.{json,yaml},
audit-core-informed-decision-ingress. (1) GH-DEC-2026-014 limit 3: the fabric
CAN carry the declaration — data is stored verbatim into details.data and
hash-chained, so content_exists and custody need no schema change and become
as tamper-evident as the commitment they accompany. It CANNOT detect
non-production: audit-core performs no retrieval and its egress permits
Postgres and DNS only. Detection happens at retrieval by the reviewer, and the
stored declaration is what makes non-production attributable rather than a
blank. Residual: a custodian that never held the content can emit a false
content_exists; audit-core validates the declaration shape, never its truth —
same class as omission at source, not closed by chain, attestation or T04/T06.
(2) Cadence: reconciliation plus heartbeat is right, with both scoped PER
CLASS rather than per source — a per-source heartbeat is satisfied by the
high-volume presentation stream and says nothing about a quiet month of
dispositions. Bound: a compromised emitter suppresses the event and its own
count together, so neither control covers the limit-3 residual. Depends on
T04/T06; declare now, do not describe as operating. (3) One source, distinct
type values per class, following approval-engine four-class shape; a second
sender would split one residual into two smaller-looking ones. (4) Tenant
provenance is recorded in the registration document, not the envelope:
audit-core does not resolve the tenant claim, it checks a value the credential
is permitted to write, and restating an unobserved route in an event is the
same error as claiming an event occurred. (5) Stated for all documents:
commitment-only satisfies non-alteration and never reconstructability, and no
audit-core document or conformance claim may describe it otherwise.'
recorded_in: docs/informed-decision-source-registration.md
work: AUDIT-WP-0009-T11
```
## AUDIT-IN-0002 — Register tenant-engine as an attributive audit-core sender
```yaml