coulomb/audit-core
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

AUDIT-WP-0013-T06: independent full-scope readers may count any source (NK-WP-0035-T04)
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details

Browse source 
GET /v1/reconciliation now admits may_read + tenants ["*"] identities for
any source, marked basis: independent_reader. Scoped readers get 403
full_tenant_scope_required; writers keep 403 source_not_allowed. Counts only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
This commit is contained in:
tegwick 2026-10-28 09:49:10 +01:00
parent 64c0fa5285
commit d46e89ee21
6 changed files with 238 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

13
docs/operator-runbook.md
View file

@ -83,8 +83,21 @@ curl -sS -H "Authorization: Bearer $OPERATOR_TOKEN" \
# Every event sharing a correlation id
curl -sS -H "Authorization: Bearer $OPERATOR_TOKEN" \
'http://127.0.0.1:8080/v1/events?correlation_id=<id>&limit=100'
# Independent per-class counts for ANY source's window (AUDIT-WP-0013-T06).
# Needs may_read AND tenants ["*"]; a scoped reader gets 403
# full_tenant_scope_required, a writer 403 source_not_allowed.
# Window is half-open on accepted_at: since <= accepted_at < until.
curl -sS -H "Authorization: Bearer $OPERATOR_TOKEN" \
'http://127.0.0.1:8080/v1/reconciliation?source=<source>&tenant=<tenant>&since=<rfc3339>&until=<rfc3339>&stream_instance_id=<id>'
```
The independent count response is the own-source shape plus
`basis: "independent_reader"`: `source`, `tenant`, `since`, `until`,
`counts` (`[{class, count}]`), optional `stream_instance_id`, and `means`.
Counts only. Sequence and lag are not aggregated; take them from the
exact-id reads above (`accepted_at`, `observed_at`, `details.data`).
Stored records keep the original `event_id`, `payload_hash`, and
`accepted_at`. Redacted fields appear in `details.redaction.paths`; the
payload itself is stored already masked.

2
docs/section-4-source-of-evidence.md
View file

@ -87,7 +87,7 @@ needs:
| --- | --- |
| The published class — load-bearing, and rare or volume | Accepting that classification as supplied and never inferring it |
| The cadence, per class | `heartbeat_classes` on the registration; `POST /v1/events` class `audit-core.heartbeat` |
| Reconciliation of its own counts | `GET /v1/reconciliation`, scoped to the caller's own sources, counts and never payloads |
| Reconciliation of its own counts | `GET /v1/reconciliation`, scoped to the caller's own sources, counts and never payloads; an independent full-scope reader (`may_read`, `tenants: ["*"]`) may count any source, marked `basis: independent_reader` (AUDIT-WP-0013-T06) |
| — | `GET /v1/stream-findings`, and the `means` field on every finding |
`access-engine`'s expectation — heartbeat plus reconciliation rather than rate,