# SCOPE

Boundary contract for `audit-core`, aligned to NetKingdom Security Layer Model
v0.7 (accepted) and its working companion. `INTENT.md` says what Audit Core is
for; this file says what it does and does not do, and is the file to check
before adding a surface.

## One-liner

The estate's Evidence engine: durable, tenant-aware custody of audit events,
with an honest and bounded integrity claim.

## Layer and role

**Engine / Evidence** (statute §3.3, §4). Deterministic API over one modeled
concept — the audit event. Declared in `INTENT.md` frontmatter and `layer.yaml`.

Audit Core is **not** a PDP, not a PIP, and not PEP-shaped. It renders no
decision, supplies no claim a decision consumes, and causes no protected side
effect of its own.

## In Scope

**Custody and integrity**

- Event ingestion, validation, normalization to the Audit Core envelope,
  redaction, and append-only operational custody.
- Sender registration and binding; tenant and scope attribution.
- Hash-chain integrity: link, verify, chain-head attestation, and the
  `GET /v1/integrity` operator surface.
- The honest custody claim — `custody_class`, `immutable`, `tamper_evidence`,
  `recoverable_days` — stated at no more than `docs/integrity.md` delivers.
- Retention profiles, search and export entitlements, dead-letter and
  secret-finding surfaces.

**Evidence-role obligations under v0.7 §9.6** *(largely not yet built — see
`workplans/AUDIT-WP-0009-evidence-role-conformance.md`)*

- Recording, per source, whether its evidence is **load-bearing** or
  **attributive**, because the obligations differ.
- Accepting and storing a source's declared **emission cadence**, and raising a
  finding when the stream falls below it — the stream observed, not only its
  contents.
- **Heartbeat** ingestion and missing-heartbeat findings for low-volume
  load-bearing classes, where rate monitoring cannot work.
- A **reconciliation** surface: per-source, per-class event counts a source can
  compare against its own state transitions.
- Registering `approval-engine` as a distinct source carrying issuance, use,
  supersession, and revocation (§9.4, `AUDIT-IN-0001`).

**Conformance**

- Machine-readable layer declaration (`layer.yaml`) and a conformance test.
- A total list of infrastructure contacts, catalogued or not, so the §5 check
  is total rather than vacuous.

## Out of Scope

**Boundaries fixed by the statute — these are permanent, not "not yet"**

- **Any authorization decision.** `access-engine` is the only decision point
  (§6). Audit Core renders and caches none.
- **An approval-validity query.** Records, yes; a verdict on whether an approval
  is still valid, never (§9.4). A consumer branching on such an answer would
  route an authorization decision through the audit fabric.
- **Operative approval state** — the durable object, atomic supersession, single
  consumption, revocation. That is `approval-engine`'s (§9.4).
- **Emission atomicity at the source.** Completeness at the boundary is the
  emitter's obligation; an archive cannot retrofit it (§9.6).
- **Any claim that the archive proves an event occurred, or that absence proves
  it did not** (§9.6).
- **Policy decision making**, per `INTENT.md`.

**Not owned here**

- Procuring or operating S3 / Barman / WAL; the `platform:audit-storage` booked
  cost or a second usage stream.
- WORM, object lock, or ITC-CAP `data.archive`. Ruled a different store with a
  different owner (statute §16); the stronger-custody gap is withdrawn, not
  pending.
- A `rapp.yaml` in this repo (schema requires `rapp-*`).
- Public ingest.
- Unrelated adjacent systems; irreversible operational decisions without human
  approval.

## Current State

- Status: production. Receiver on railiance01 (`namespace audit-core`), Postgres
  operational custody on `platform-pg`, sender `user-engine`.
- Recovery is the platform `data.backup` window (30 days). `/readyz` reports
  `custody_class=operational`, `recoverable_days=30`.
- Hash chain verified on 30 live events
  (`docs/evidence/chain-head-20260816.json`).
- ITC-CAP case: `data/capability/audit-core-operational.json` at D4.
- Tenancy posture: `tenancy.yaml` — declared `I1 A2 E1 P1 R1`, target `E3`/`R2`.

**Known conformance gaps** (assessed 2026-08-29,
`history/2026-08-29-v0.7-alignment-and-scope-assessment.md`):

- `tamper_evidence=True` is returned unconditionally by the Postgres backend
  while `docs/integrity.md` permits it only when a live external attestation
  exists. The one attestation on record is 2026-08-16 and no job renews it.
  This is Audit Core overclaiming its own bound — the §9.6 defect turned inward.
- No cadence, heartbeat, reconciliation, or load-bearing classification exists.
  The §9.6 obligations Audit Core argued for are not yet supportable by Audit
  Core.
- `approval-engine` is not yet registered as a source.
- No negative test asserts the absence of an approval-validity surface.

## Getting Oriented

- Start with: `INTENT.md`, then `net-kingdom/SECURITY-COMPANION.md`
- Bound on what may be claimed: `docs/integrity.md`
- Agent instructions: `AGENTS.md`
- Workplans: `workplans/`