Publish authoritative E2 owner and original evidence expiry

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2

docs/evidence/posture-feedback-adoption-2026-10-15.json

@@ -0,0 +1,58 @@
+{
+  "workplan": "NK-WP-0031",
+  "as_of": "2026-10-15T17:27:15Z",
+  "result": "adoption-complete; E2 expired",
+  "authority": "Founder requested NK-WP-0031 completion; source metadata published in audit-core/tenancy.yaml. No evaluator remediation writes or live test authorized.",
+  "source_refs": {
+    "receipt": "audit-core/docs/evidence/AUDIT-WP-0008-T05-whitehat-e2-03-pass-2026-08-22.md",
+    "report": "audit-core/docs/evidence/AUDIT-WP-0008-T05-whitehat-e2-03-final-report.json",
+    "owner_adoption": "audit-core/workplans/ADHOC-2026-10-15.md"
+  },
+  "sha256": {
+    "source_declaration": "3271f63beb8079bc85e34db83f64b8e0b766ff1e203d4a9958c21e0f7902111e",
+    "original_declaration": "0f0fa7ba83de6fa822b8ab10121e29c710b9566afa6b9de30340a6263a0dfbba",
+    "source_receipt": "8210d9e9adfcc0f2e568549b26eca4977176bc05ae234811c9ce45352c5d911c",
+    "source_report": "2d5a21141b78024a5334881e2b7fd62a69c46931057f77515a6c6f18ec497593"
+  },
+  "reports": {
+    "before.json": "aee6f364162c3bfc5c4fd52d23f3505e82aa6a490276b3449a9eb15506b637df",
+    "after.json": "bd53b4920222db5a01269f598d1d9e901c92e5cb9d24f46158fe443008e19d3a",
+    "fail-on-high.json": "7aa68cd122566a7080acb63dc755ae46fd6cd887f048dbbf37aa60fd4f44cd8d"
+  },
+  "verification": {
+    "schema_and_semantics": "valid",
+    "focused_tests": 28,
+    "repeat_report_byte_identical": true,
+    "fail_on_high_exit": 1,
+    "original_posture_evidence_and_review_dates_unchanged": true,
+    "feedback_external_writes": false
+  },
+  "before": {
+    "E2": "evidence-freshness-unknown",
+    "owner": "unknown",
+    "unknown_owner_findings": 10
+  },
+  "after": {
+    "E2": "evidence-expired",
+    "owner": "audit-core",
+    "valid_until": "2026-08-23T22:10:25Z",
+    "unknown_owner_findings": 0,
+    "high_findings": 2,
+    "declared_gaps": 8
+  },
+  "residual": {
+    "workplan": "AUDIT-WP-0015",
+    "task": "AUDIT-WP-0015-T02",
+    "status": "wait",
+    "scope": "Owner prerequisites and fresh approved E2 engagement; old engagements remain terminal. Posture review remains overdue, E2 remains expired."
+  },
+  "knowledge": {
+    "version": "0.2.6",
+    "digest": "8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02",
+    "cards": [
+      "start",
+      "evidence"
+    ],
+    "status": "withheld/orientation-only; directly reviewed cards and current source evidence and owner instructions"
+  }
+}

tenancy.yaml

@@ -1,6 +1,6 @@
 # audit-core tenancy posture
 #
-# Declared per NetKingdom Tenancy Posture v0.1 (draft-8),
+# Declared per NetKingdom Tenancy Posture v0.1 (draft-14),
 # net-kingdom/canon/standards/tenancy-posture_v0.1.md.
 # Location and schema per Decision 5.4; per-path detail per Decision 5.2;
 # provider block per Decision 5.5.
@@ -13,6 +13,7 @@ schema_version: "0.1"
 framework: netkingdom-tenancy-posture
 service: audit-core
 role: tenant-audit-service
+responsible_repo: audit-core
 
 tenancy:
   reviewed: "2026-08-22"
@@ -171,3 +172,30 @@ evidence:
   R2:
     - "rapp-postgres/consumers/audit-core.yaml"
     - "tests/test_interface.py"
+
+# NK-WP-0031: structured publication of the existing bounded E2 receipt.
+# Adoption records its original expiry; it does not renew evidence or approve
+# another engagement. Recovery evidence for V1 is not E2 evidence.
+evidence_freshness:
+  E2:
+    kind: adversarial
+    observed_at: "2026-08-22T22:10:25Z"
+    valid_until: "2026-08-23T22:10:25Z"
+    responsible_repo: audit-core
+    scope: >-
+      WH-ENG-20260822-AUDIT-E2-03: ten operations across the event-by-id,
+      correlation-slice and append-as-other-tenant probes. The ordinary
+      tenant-A identity could not read or append tenant-B fixtures. Supports
+      only the attempted attacks on the pinned target revision, not an
+      assertion that the boundary always holds. Receipt:
+      docs/evidence/AUDIT-WP-0008-T05-whitehat-e2-03-pass-2026-08-22.md.
+    remediation: >-
+      Under AUDIT-WP-0015-T02, obtain the owner-confirmed bounded identities
+      and a new Whitehat engagement with fresh plane admission and exact
+      rules-of-engagement approval; run the cross-tenant E2 probes, complete
+      receipt-bound cleanup, and publish the replacement report and freshness
+      metadata. Prior -01/-02/-03 engagements are terminal and cannot be reused.
+      Re-evaluate after relevant boundary changes before promotion. A later
+      recovery exercise does not renew E2, and this declaration authorizes
+      no live run.
+    source_revision: "sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6"

workplans/ADHOC-2026-10-15.md

@@ -0,0 +1,43 @@
+---
+id: ADHOC-2026-10-15
+type: workplan
+title: "Publish existing E2 evidence freshness metadata"
+domain: infotech
+repo: audit-core
+status: finished
+owner: codex
+topic_slug: audit-evidence-dependencies
+created: "2026-10-15"
+updated: "2026-10-15"
+---
+
+# Publish existing E2 evidence freshness metadata
+
+## Adopt NK-WP-0031 freshness fields
+
+```task
+id: ADHOC-2026-10-15-T01
+status: done
+priority: medium
+```
+
+Publish responsible_repo and evidence_freshness.E2 in tenancy.yaml from the
+existing AUDIT-WP-0008-T05 target receipt and source declaration. Preserve the
+2026-08-22 observation, 2026-08-23 expiry, bounded scope and target digest.
+Re-evaluate with the explicit current as-of used in NK-WP-0031. This is source
+metadata adoption only, not fresh E2, a posture-level change or a live run.
+Actual replacement remains tracked by AUDIT-WP-0015-T02; do not close it on
+this metadata adoption.
+
+
+Verified 2026-10-15: canonical schema and semantic validation pass; 28 focused
+NetKingdom evaluator/tenancy tests pass. At explicit as-of
+2026-10-15T17:27:15Z, E2 is expired and owned by audit-core, the report is
+byte-identical on repetition, and --fail-on high returns 1. Original posture
+levels, review dates and evidence references are unchanged. No live run or
+runtime mutation occurred. NK-WP-0031-T04 is complete on this source adoption.
+
+Provenance/digests: `docs/evidence/posture-feedback-adoption-2026-10-15.json`.
+Existing AUDIT-WP-0015-T02 retains replacement E2 and owner prerequisites;
+this metadata publication neither closes that task nor reuses a terminal
+engagement. No additional residual work is created by this source correction.