Prepare compatible audit receiver with verified container lifecycle

Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
2026-09-11 06:46:15 +02:00 · 2026-09-11 06:46:15 +02:00 · cb23dc82fd
commit cb23dc82fd
parent f1b0577095
8 changed files with 426 additions and 17 deletions
--- a/docs/evidence/2026-09-11-factory-receiver-release.json
+++ b/docs/evidence/2026-09-11-factory-receiver-release.json
@ -0,0 +1,109 @@
+{
+  "status": "release_prepared",
+  "source_base": "f1b05770956a251da1b9de274f6bd1de5e325b5f",
+  "receiver_tests": {
+    "passed": 229,
+    "command": "PYTHONPATH=../infospace-bench/src AUDIT_CORE_TEST_DATABASE_URL=<disposable-postgres> python -m pytest -q -ra --ignore=tests/test_migrate_store.py",
+    "excluded": "tests/test_migrate_store.py: five pre-existing failures, one passing empty case. AUDIT-IN-0004 owns repair. No native import."
+  },
+  "container": {
+    "image": "audit-core:hfact-20260911-hardened",
+    "native_credentials_used": false,
+    "checks": {
+      "operational_ready": true,
+      "nonroot_readonly": true,
+      "approval-engine": {
+        "accepted": 202,
+        "duplicate": 200,
+        "wrong_source": 400,
+        "wrong_tenant": 400,
+        "read_routes_denied": 7,
+        "independent_read": 200,
+        "redacted": true,
+        "stored_once": true
+      },
+      "informed-decision": {
+        "accepted": 202,
+        "duplicate": 200,
+        "wrong_source": 400,
+        "wrong_tenant": 400,
+        "read_routes_denied": 7,
+        "independent_read": 200,
+        "redacted": true,
+        "stored_once": true
+      },
+      "sigterm": {
+        "exit_code": 0,
+        "inflight_committed_once": true,
+        "restart_retry_duplicate": true,
+        "chain_intact": true
+      }
+    },
+    "started_at": "2026-09-11T04:43:46.088591+00:00",
+    "status": "passed",
+    "own_fixture_cleanup": true
+  },
+  "schema_comparison": {
+    "live": {
+      "0001-events": "e613b4bfb54914fbd98a4abd1fd6017e37108df43ffc306ab825f2d5a8afdd3c",
+      "0002-append-only": "29251f9300f33cfb90fd40677f5fedbe40057e1c0c866cd29a1d2cb160c4a762",
+      "0003-dead-letters": "a82024b5b4137aecc7885ac8e1212b1711dd06bc5806a01e79882c4a1092d341",
+      "0004-secret-findings": "f269be3e19d2f69673b96a65fa33a2b1f863a39dfff6f9937062ab6aa58f63e5",
+      "0005-runtime-grants": "008247e2daeae5a286cd6e46328fbf0d15fa70c6a99b69cadb296a0c713791fe",
+      "0006-chain": "a984f8226a5d407f990447110f0dd61e400ef4d9da952a268872e5e75f81db2d"
+    },
+    "candidate": {
+      "0001-events": "e613b4bfb54914fbd98a4abd1fd6017e37108df43ffc306ab825f2d5a8afdd3c",
+      "0002-append-only": "29251f9300f33cfb90fd40677f5fedbe40057e1c0c866cd29a1d2cb160c4a762",
+      "0003-dead-letters": "a82024b5b4137aecc7885ac8e1212b1711dd06bc5806a01e79882c4a1092d341",
+      "0004-secret-findings": "f269be3e19d2f69673b96a65fa33a2b1f863a39dfff6f9937062ab6aa58f63e5",
+      "0005-runtime-grants": "008247e2daeae5a286cd6e46328fbf0d15fa70c6a99b69cadb296a0c713791fe",
+      "0006-chain": "a984f8226a5d407f990447110f0dd61e400ef4d9da952a268872e5e75f81db2d"
+    }
+  },
+  "native_before": {
+    "ready": {
+      "status": "ok",
+      "custody_class": "operational",
+      "durable": true,
+      "tamper_evidence": true,
+      "recoverable_days": 30,
+      "recoverable_source": "resource-control/data/capability/platform-audit-storage.json#provisions[capability=data.backup]",
+      "recoverable_basis": "measured"
+    },
+    "chain": {
+      "intact": true,
+      "events": 32,
+      "head": "9fc0b4f25c562cec037a5077f00ee63380db8b5c4e85b6016fc40b301431e4fd",
+      "head_event_id": "whitehat-e2-event-b-20260822-03",
+      "head_accepted_at": "2026-08-22T22:09:37+00:00",
+      "first_break": null,
+      "attestation_match": null
+    },
+    "image": "forgejo.coulomb.social/coulomb/audit-core@sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6",
+    "generation": 15,
+    "deployment_uid": "b85fe3d0-75c9-4e0d-8c34-c6f1df0881bb"
+  },
+  "scan": {
+    "candidate": {
+      "sha256": "33be06088970b025af916a81ad3833313749c2ff25f0fd99641b6fc4823c1ff3",
+      "vulnerabilities": {
+        "LOW": 85,
+        "HIGH": 81,
+        "MEDIUM": 99,
+        "UNKNOWN": 6,
+        "CRITICAL": 3
+      }
+    },
+    "hardened": {
+      "sha256": "c7598f203067f36be1d0c0f2a7b33c3e02b13583d605d7091baea1bb380f604f",
+      "vulnerabilities": {}
+    },
+    "scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
+    "warning": "OS lifecycle list does not yet include Alpine 3.24; vulnerability scanner recognized Alpine 3.24 repository."
+  },
+  "old_candidate_sigterm_exit": 137,
+  "native_rollout": "pending",
+  "factory_attempts": 0,
+  "paid_model_calls": 0
+}