AUDIT-WP-0009 T02/T10 — schedule attestation, and make the §5 check total

T02. deploy/attest-cronjob.yaml: daily at 03:17 UTC against the 168h window,
its own ServiceAccount, and a Role reaching exactly one named ConfigMap —
get/update/patch, no create, no list. audit_core/attest_publish.py does the
publish in stdlib; the image carries no kubectl, and adding one to an audit
receiver's image to write a single file is the worse trade.

Three refusals, all deliberate:

  The producer is not the receiver. A receiver that could rewrite its own
  attestation could forge it. audit-core-egress is now scoped to
  component: receiver and a separate audit-core-attest-egress carries the 6443
  rule, so the receiver never gains API-server reach. Asserted by test.

  It refuses to publish over a broken chain. A fresh head written over a break
  replaces an honest chain_break with a fresh-looking attestation. Stale
  degrades the claim visibly; false does not.

  Mounted as a directory, not subPath. Found while writing the manifest: a
  subPath ConfigMap mount is resolved once at pod start and never updates, so
  the daily attestation would land in the ConfigMap and never reach the running
  receiver — tamper_evidence would age out to false while the job reported
  success every night, silent in both directions.

The offsite copy stays an operator step. audit-core holds no Nextcloud
credential and should not acquire one to publish a hash, so docs/integrity.md
states the bound plainly: until that copy exists the delivered control defends
against a database owner, not a cluster owner, and no stronger claim may be
made from it.

T10. layer.yaml lists four infrastructure contacts — platform-pg, state-hub,
kube-apiserver, the container registry — each with its role and whether another
layer reads it. tooling_contacts stays [], which is true under §5 as written;
the companion's totality request is met by the uncatalogued list rather than by
inventing a Tooling row. tests/test_layer_conformance.py derives the egress
destinations from the manifests and the registry from the pinned digests, so a
new contact appearing in deploy/ without a row fails the test rather than
waiting for a reviewer to notice.

Applying the manifests remains an operator action; nothing here was applied.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nb7Q6ZmXppNDkTWytfYqfv

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2069992@bnt-lap001
Assistant-Session: 167dd7f8-2a25-4be1-aa46-3b6f1a5f94c6

deploy/audit-core.yaml

@@ -66,6 +66,12 @@ spec:
     metadata:
       labels:
         app.kubernetes.io/name: audit-core
+        # Distinguishes receiver pods from the attestation CronJob's pods,
+        # which share the name label. NetworkPolicy audit-core-egress is
+        # scoped to this value so the receiver never gains the attest job's
+        # API-server reach (AUDIT-WP-0009-T02). Not in the Deployment's
+        # selector, which is immutable and does not need it.
+        app.kubernetes.io/component: receiver
     spec:
       securityContext:
         runAsNonRoot: true
@@ -127,6 +133,17 @@ spec:
             # below deploy/senders-scope.json.
             - name: AUDIT_CORE_SENDERS_SCOPE_PATH
               value: /etc/audit-core/senders-scope.json
+            # Chain-head attestation, written by the audit-core-attest CronJob
+            # and mounted read-only here (AUDIT-WP-0009-T02). The receiver
+            # reads it and never writes it: a receiver that could rewrite its
+            # own attestation could forge it, which is why the job is a
+            # separate workload with a separate identity.
+            #
+            # Absent, empty or stale degrades tamper_evidence rather than
+            # failing the pod — that is T01's intended behaviour and the
+            # correct state before the first run.
+            - name: AUDIT_CORE_ATTESTATION_PATH
+              value: /etc/audit-core/attestation/chain-head.json
           resources:
             requests:
               cpu: 50m
@@ -153,6 +170,16 @@ spec:
               mountPath: /etc/audit-core/senders-scope.json
               subPath: senders-scope.json
               readOnly: true
+            # Mounted as a DIRECTORY, deliberately, and not with subPath.
+            # A subPath ConfigMap mount is resolved once at pod start and
+            # never updates — the daily attestation would land in the
+            # ConfigMap and never reach the running receiver, so
+            # tamper_evidence would age out to false while the job reported
+            # success every night. A directory mount is updated in place by
+            # the kubelet, and the backend re-reads the file per check.
+            - name: chain-head
+              mountPath: /etc/audit-core/attestation
+              readOnly: true
           startupProbe:
             httpGet: {path: /healthz, port: http}
             periodSeconds: 3
@@ -188,3 +215,9 @@ spec:
           configMap:
             name: audit-core-senders-scope
             defaultMode: 0444
+        - name: chain-head
+          configMap:
+            name: audit-core-chain-head
+            defaultMode: 0444
+            # optional: the pod must start before the first attestation exists.
+            optional: true