# audit-core — NetKingdom security layer declaration
#
# Framework: net-kingdom/canon/standards/security-layer-model_v0.7.md
# Assent:    AUDIT-IN-0001 (audit-core's own voice, per §11 "who must declare")
#            history/2026-08-28-approval-evidence-assent.md
#            history/2026-08-29-security-layer-model-v0.6-review.md
#            history/2026-08-29-v0.7-alignment-and-scope-assessment.md
#
# Reference form offered by ops-warden and adopted here, so §11's declaration
# check is mechanical rather than a reader's judgment about prose. audit-core
# raised that defect; adopting the form is the other half of raising it.

schema_version: "0.1"
framework: netkingdom-security-layer-model
standard_version: "0.7"
repository: audit-core
layer: engine
role: evidence                        # §3.3 engine typing
declared_by: intakes/intakes.md AUDIT-IN-0001
declared_at: "2026-08-29"

# §3.3: an Evidence engine records what happened and proves integrity of what
# it holds. It is explicitly not a decision point (§6, §9.4).
decision_surfaces_exposed: none

# §9.4 — normative and permanent. audit-core exposes no verdict on whether an
# approval is still valid; a consumer branching on such an answer would route an
# authorization decision through the audit fabric.
approval_validity_query: forbidden

# §5 applies to Staff. audit-core is an Engine and holds no §4 Tooling contact
# (key-cape, OpenBao). Companion §4 asks that UNCATALOGUED infrastructure be
# listed anyway so the check is total rather than vacuous, and that carve-out
# sunsets within two review intervals for a store another layer reads.
#
# Completed 2026-09-10 (AUDIT-WP-0009-T10). The list below is asserted total by
# `tests/test_layer_conformance.py`, which fails when a new infrastructure
# contact appears in `deploy/` without a row here — the check is mechanical
# rather than a promise to remember.
tooling_contacts: []
uncatalogued_infrastructure:
  - id: platform-pg
    system: CNPG PostgreSQL on railiance01
    role: audit-core's own operational custody store
    read_by_other_layers: true          # subject to the companion §4 sunset
    note: >-
      Not a §4 Tooling row. Listed for totality, not as a declared gap.
  - id: state-hub
    system: Custodian State Hub
    role: >-
      Work coordination only. Reads and writes workplans, tasks, intakes and
      progress events. Carries no audit event, no sender credential and no
      custody role, and audit-core's runtime does not contact it — this is a
      development-time contact, listed because §5 totality does not distinguish.
    read_by_other_layers: false
  - id: kube-apiserver
    system: k3s API server on railiance01
    role: >-
      Written by the audit-core-attest CronJob to publish the chain-head
      attestation into one named ConfigMap (AUDIT-WP-0009-T02). The receiver
      has no API-server egress: a receiver able to rewrite its own attestation
      could forge it, so the reach belongs to the attest workload alone.
    read_by_other_layers: false
  - id: forgejo.coulomb.social
    system: Container registry
    role: >-
      Image source, pinned by digest in deploy/. Build-time contact; no runtime
      call. Listed because a registry that can change what runs is an
      infrastructure contact whether or not §5 catalogues it.
    read_by_other_layers: false

# §9.6 — the bound audit-core delivers, stated so no doctrine rests on more.
evidence_bound:
  proves:
    - records held were not altered after arrival
    - records held were not truncated after arrival
  does_not_prove:
    - that a record was ever sent
    - absence of a record as evidence of non-occurrence
  conditional_on:
    - external chain-head attestation stored outside platform-pg
  contract: docs/integrity.md
  not_claimed: [WORM, object-lock, archival-custody]