schema: info-tech-canon.interface-card.v1
id: audit-core/interface-card
title: audit-core Canon Interface Card
consumer: audit-core
consumer_profile:
  repo: audit-core
  domain: infotech
  owner: audit-core
  intent: >
    Provide durable, tenant-aware operational custody for audit events so
    senders can treat a 202 as evidence-in-store, not a log-forwarding hint.
  scope:
    - audit event ingestion
    - append-only operational custody
    - sender binding
    - recovery bound to platform backup
  purposes:
    - id: audit-core/operational-custody
      use_case: Accept normalized events from registered senders and retain them in an append-only store.
      consumer_need: A joinable operations.audit provision with an honest recovery claim.
      demand_signals:
        - user-engine delivers platform and tenant events over POST /v1/events
        - neighbours already require data.backup in ITC-CAP terms
canon_surfaces:
  - model/capability
  - model/governance
  - model/data
  - model/security
surfaces:
  implemented_profiles: []
  consumed_artifacts:
    - model/capability
    - model/governance
    - model/data
    - model/security
  owned_concepts: []
  produced_concepts:
    - Evidence
    - AuditRecord
  consumed_concepts:
    - Evidence
    - EvidenceBasis
    - CapabilityProvision
    - RetentionRuleReference
  mappings:
    - from: stored event
      to: Evidence / AuditRecord
      note: This service stores evidence. It is not an independent Audit-as-assessment.
    - from: capability.audit.event-retain
      to: operations.audit
      note: data/capability/audit-core-operational.json
validation_expectations:
  commands:
    - PYTHONPATH=src python3 -m info_tech_canon capability-review /home/worsch/audit-core/data/capability/audit-core-operational.json
  evidence_required:
    - data/capability/audit-core-operational.json
    - docs/operator-runbook.md Restore section
    - docs/evidence/restore-walk-20260813T121200Z.json
  known_gaps:
    - id: data.archive-unprovided
      owner: audit-core
      disposition: unmet requirement recorded on the ITC-CAP case; do not build the sink in AUDIT-WP-0006
    - id: tamper-evidence-false
      owner: audit-core
      disposition: closed by AUDIT-WP-0007; proof bound is in docs/integrity.md
    - id: no-hash-chain
      owner: audit-core
      disposition: INTENT residual, not this workplan
    - id: single-sender
      owner: audit-core
      disposition: NetworkPolicy admits user-engine only; other sources remain adapters
    - id: no-rapp-yaml
      owner: railiance-master
      disposition: schema requires rapp-*; extraction is a first-wave family decision
    - id: historic-archive-overclaim
      owner: audit-core
      disposition: closed by AUDIT-WP-0006-T01; /readyz reports operational
purpose_fit:
  state: partial
  matched_capabilities:
    - operations.audit
  scope_pressure: >
    INTENT describes a control plane, object archive, hot search, and export.
    The live service is a single-sender operational custody receiver.
  recommended_disposition: keep the operational provision honest; do not inflate to data.archive
consumer_needs:
  current:
    - Honest custody_class and recoverable window on /readyz
    - Joinable operations.audit provision
  requested_extensions:
    - data.archive sink if events must survive past the 30-day backup window
  feedback: []
tenancy_posture:
  declared_at: tenancy.yaml
  framework: net-kingdom/canon/standards/tenancy-posture_v0.1.md (draft-8)
  current: I1 A2 E1 P1 R1
  target: I1 A2 E3 P1 R2
  provides_reachable:
    E2: now
    E3: not yet — needs rapp-postgres ADR-0003 GUC contract; target 2027-03-31
    E4: unreachable — one database, one runtime credential, no per-tenant substrate
    R4: unreachable by design — see Decision 4.5.3 and docs/erasure-and-audit.md
known_deviations:
  - no data.archive sink
  - tamper_evidence is a hash chain plus external head, not WORM
  - no hash-chain
  - single sender user-engine
  - no rapp.yaml (not a rapp-* repo)
  - /readyz historically overclaimed archive (closed by T01)