tegwick
3c2cdcdf79
Registration: attributive, with the declared completeness_trade recorded on the receiver side rather than only in the emitter, per §9.6's requirement that the trade travel with the trail. tenants ["*"] is justified rather than inherited — tenant-engine's events carry the affected tenant, the set is every tenant including ones created later, and an explicit list would fail closed at exactly the moment a tenant is provisioned, dead-lettering the creation evidence of the tenant whose creation it is. source stays pinned exactly. Ingress ANDs namespace and pod label; a weaker evidence class is not a reason for a wider network rule. All inert until the token exists. Then the finding T04 existed to find: tenant-engine cannot deliver a single event today. envelope_for sends five required fields under other names — event_id, action, resource, observed_at, details — and omits correlation_id entirely, so normalize() raises invalid_event. Verified by running the real envelope through the real function, not by reading. Worse than an ordinary integration bug. The drain treats 400 as terminal, so the outbox row is marked handled while audit-core holds only a dead letter, which is not chained and is not custody. Lost on both sides, and since the drain is non-blocking and attributive, nothing fails loudly — a silent total loss of the stream presenting as a working integration. Taking the correction the intake invited rather than accepting a lossy record. normalize() is NOT relaxed to accept the alternate spellings: a receiver that guesses which sender key means which stored field has made the mapping its own, and the record stops being the sender's assertion. correlation_id cannot be synthesized at all — an invented one ties an event to an operation audit-core never observed. Root cause is ours. The accepted envelope was published nowhere a sender could read it; audit-backend-contract.md describes the stored record, and a sender reading it would reasonably infer exactly the names tenant-engine used. schema_version audit-core.event.v1alpha1 selects nothing here and gave a false impression of a negotiated contract. Published docs/event-envelope.md as the wire contract, including the point that a 400 means the event is not in the archive and must be treated as a defect to fix rather than a delivery outcome. T05 moved to wait: nothing to prove end to end until an event can be accepted. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Nb7Q6ZmXppNDkTWytfYqfv Assistant: claude-code Assistant-Model: opus Assistant-Process: 2069992@bnt-lap001 Assistant-Session: 167dd7f8-2a25-4be1-aa46-3b6f1a5f94c6
72 lines
2 KiB
YAML
72 lines
2 KiB
YAML
# Non-secret sender scope (AUDIT-WP-0006-T05). Tokens stay in Secret
|
|
# audit-core-senders. This ConfigMap is the authority for tenants/sources
|
|
# so an ExternalSecret refresh cannot revert user-engine to a single tenant.
|
|
# Keep in lockstep with deploy/senders-scope.json.
|
|
#
|
|
# The overlay only ever applies to a sender the Secret already carries, so an
|
|
# entry here for a sender with no token yet is inert. That is what makes the
|
|
# approval-engine entry safe to land ahead of its credential.
|
|
#
|
|
# evidence_kind may be raised here (attributive -> load-bearing) but never
|
|
# lowered: a ConfigMap refresh must not be able to drop a source's §9.6
|
|
# atomicity and detection obligations without anyone deciding to.
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: audit-core-senders-scope
|
|
namespace: audit-core
|
|
labels:
|
|
app.kubernetes.io/name: audit-core
|
|
data:
|
|
senders-scope.json: |
|
|
[
|
|
{
|
|
"name": "user-engine",
|
|
"sources": [
|
|
"user-engine"
|
|
],
|
|
"tenants": [
|
|
"*"
|
|
],
|
|
"may_write": true,
|
|
"may_read": false
|
|
},
|
|
{
|
|
"name": "tenant-engine",
|
|
"sources": [
|
|
"tenant-engine"
|
|
],
|
|
"tenants": [
|
|
"*"
|
|
],
|
|
"may_write": true,
|
|
"may_read": false,
|
|
"evidence_kind": "attributive",
|
|
"completeness_trade": "outbox drains after commit, not inside the mutation transaction; declared at tenant-engine/docs/evidence-emission.md"
|
|
},
|
|
{
|
|
"name": "approval-engine",
|
|
"sources": [
|
|
"approval-engine"
|
|
],
|
|
"tenants": [
|
|
"tenant:platform"
|
|
],
|
|
"may_write": true,
|
|
"may_read": false,
|
|
"evidence_kind": "load-bearing"
|
|
},
|
|
{
|
|
"name": "informed-decision",
|
|
"sources": [
|
|
"informed-decision"
|
|
],
|
|
"tenants": [
|
|
"tenant:platform"
|
|
],
|
|
"may_write": true,
|
|
"may_read": false,
|
|
"evidence_kind": "load-bearing"
|
|
}
|
|
]
|