tegwick
4d5d989344
The framework moved from draft-5 to draft-8 while this workplan ran. No finding was reversed, but three things changed underneath it: R moved to 2 once rapp-postgres declared the window, a sixth axis V (availability) appeared, and the implemented-versus-evidenced distinction became a schema field. T03 reduces: the confirmation-oracle finding landed as Decision 4.5.3 and question 11 is marked framework-resolved, so no amendment remains -- only our own position document. The legal question routes to risk-nexus rather than the-custodian, per §19.11 and policy-nexus INTENT. T06 reduces to confirmation: all five findings were adopted and the two stale status lines it was going to flag are already fixed. T07 is new. V1 needs critical dependencies enumerated, restart recovery exercised and recovery time measured. The 2026-08-16 reboot walk observed ~40s of unreadiness but is not an exercise and does not enumerate the dependency set. T08 is new and covers two defects in our own declaration. provider.R.available quotes a 30-day horizon we do not solely control -- at P1 the horizon is the instance maximum across co-residents. And under Decision 6.1, user-engine was never told what we declared, which makes the declaration drift rather than a completed change. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
109 lines
4 KiB
YAML
109 lines
4 KiB
YAML
schema: info-tech-canon.interface-card.v1
|
|
id: audit-core/interface-card
|
|
title: audit-core Canon Interface Card
|
|
consumer: audit-core
|
|
consumer_profile:
|
|
repo: audit-core
|
|
domain: infotech
|
|
owner: audit-core
|
|
intent: >
|
|
Provide durable, tenant-aware operational custody for audit events so
|
|
senders can treat a 202 as evidence-in-store, not a log-forwarding hint.
|
|
scope:
|
|
- audit event ingestion
|
|
- append-only operational custody
|
|
- sender binding
|
|
- recovery bound to platform backup
|
|
purposes:
|
|
- id: audit-core/operational-custody
|
|
use_case: Accept normalized events from registered senders and retain them in an append-only store.
|
|
consumer_need: A joinable operations.audit provision with an honest recovery claim.
|
|
demand_signals:
|
|
- user-engine delivers platform and tenant events over POST /v1/events
|
|
- neighbours already require data.backup in ITC-CAP terms
|
|
canon_surfaces:
|
|
- model/capability
|
|
- model/governance
|
|
- model/data
|
|
- model/security
|
|
surfaces:
|
|
implemented_profiles: []
|
|
consumed_artifacts:
|
|
- model/capability
|
|
- model/governance
|
|
- model/data
|
|
- model/security
|
|
owned_concepts: []
|
|
produced_concepts:
|
|
- Evidence
|
|
- AuditRecord
|
|
consumed_concepts:
|
|
- Evidence
|
|
- EvidenceBasis
|
|
- CapabilityProvision
|
|
- RetentionRuleReference
|
|
mappings:
|
|
- from: stored event
|
|
to: Evidence / AuditRecord
|
|
note: This service stores evidence. It is not an independent Audit-as-assessment.
|
|
- from: capability.audit.event-retain
|
|
to: operations.audit
|
|
note: data/capability/audit-core-operational.json
|
|
validation_expectations:
|
|
commands:
|
|
- PYTHONPATH=src python3 -m info_tech_canon capability-review /home/worsch/audit-core/data/capability/audit-core-operational.json
|
|
evidence_required:
|
|
- data/capability/audit-core-operational.json
|
|
- docs/operator-runbook.md Restore section
|
|
- docs/evidence/restore-walk-20260813T121200Z.json
|
|
known_gaps:
|
|
- id: data.archive-unprovided
|
|
owner: audit-core
|
|
disposition: unmet requirement recorded on the ITC-CAP case; do not build the sink in AUDIT-WP-0006
|
|
- id: tamper-evidence-false
|
|
owner: audit-core
|
|
disposition: closed by AUDIT-WP-0007; proof bound is in docs/integrity.md
|
|
- id: no-hash-chain
|
|
owner: audit-core
|
|
disposition: INTENT residual, not this workplan
|
|
- id: single-sender
|
|
owner: audit-core
|
|
disposition: NetworkPolicy admits user-engine only; other sources remain adapters
|
|
- id: no-rapp-yaml
|
|
owner: railiance-master
|
|
disposition: schema requires rapp-*; extraction is a first-wave family decision
|
|
- id: historic-archive-overclaim
|
|
owner: audit-core
|
|
disposition: closed by AUDIT-WP-0006-T01; /readyz reports operational
|
|
purpose_fit:
|
|
state: partial
|
|
matched_capabilities:
|
|
- operations.audit
|
|
scope_pressure: >
|
|
INTENT describes a control plane, object archive, hot search, and export.
|
|
The live service is a single-sender operational custody receiver.
|
|
recommended_disposition: keep the operational provision honest; do not inflate to data.archive
|
|
consumer_needs:
|
|
current:
|
|
- Honest custody_class and recoverable window on /readyz
|
|
- Joinable operations.audit provision
|
|
requested_extensions:
|
|
- data.archive sink if events must survive past the 30-day backup window
|
|
feedback: []
|
|
tenancy_posture:
|
|
declared_at: tenancy.yaml
|
|
framework: net-kingdom/canon/standards/tenancy-posture_v0.1.md (draft-8)
|
|
current: I1 A2 E1 P1 R1
|
|
target: I1 A2 E3 P1 R2
|
|
provides_reachable:
|
|
E2: now
|
|
E3: not yet — needs rapp-postgres ADR-0003 GUC contract; target 2027-03-31
|
|
E4: unreachable — one database, one runtime credential, no per-tenant substrate
|
|
R4: unreachable by design — see Decision 4.5.3 and docs/erasure-and-audit.md
|
|
known_deviations:
|
|
- no data.archive sink
|
|
- tamper_evidence is a hash chain plus external head, not WORM
|
|
- no hash-chain
|
|
- single sender user-engine
|
|
- no rapp.yaml (not a rapp-* repo)
|
|
- /readyz historically overclaimed archive (closed by T01)
|