Reliable multi-tenant auto setup audit capability
tegwick
3c2cdcdf79
Registration: attributive, with the declared completeness_trade recorded on the receiver side rather than only in the emitter, per §9.6's requirement that the trade travel with the trail. tenants ["*"] is justified rather than inherited — tenant-engine's events carry the affected tenant, the set is every tenant including ones created later, and an explicit list would fail closed at exactly the moment a tenant is provisioned, dead-lettering the creation evidence of the tenant whose creation it is. source stays pinned exactly. Ingress ANDs namespace and pod label; a weaker evidence class is not a reason for a wider network rule. All inert until the token exists. Then the finding T04 existed to find: tenant-engine cannot deliver a single event today. envelope_for sends five required fields under other names — event_id, action, resource, observed_at, details — and omits correlation_id entirely, so normalize() raises invalid_event. Verified by running the real envelope through the real function, not by reading. Worse than an ordinary integration bug. The drain treats 400 as terminal, so the outbox row is marked handled while audit-core holds only a dead letter, which is not chained and is not custody. Lost on both sides, and since the drain is non-blocking and attributive, nothing fails loudly — a silent total loss of the stream presenting as a working integration. Taking the correction the intake invited rather than accepting a lossy record. normalize() is NOT relaxed to accept the alternate spellings: a receiver that guesses which sender key means which stored field has made the mapping its own, and the record stops being the sender's assertion. correlation_id cannot be synthesized at all — an invented one ties an event to an operation audit-core never observed. Root cause is ours. The accepted envelope was published nowhere a sender could read it; audit-backend-contract.md describes the stored record, and a sender reading it would reasonably infer exactly the names tenant-engine used. schema_version audit-core.event.v1alpha1 selects nothing here and gave a false impression of a negotiated contract. Published docs/event-envelope.md as the wire contract, including the point that a 400 means the event is not in the archive and must be treated as a defect to fix rather than a delivery outcome. T05 moved to wait: nothing to prove end to end until an event can be accepted. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Nb7Q6ZmXppNDkTWytfYqfv Assistant: claude-code Assistant-Model: opus Assistant-Process: 2069992@bnt-lap001 Assistant-Session: 167dd7f8-2a25-4be1-aa46-3b6f1a5f94c6 |
||
|---|---|---|
| .claude/rules | ||
| .forgejo/workflows | ||
| .repo-manager | ||
| audit_core | ||
| data/capability | ||
| deploy | ||
| docs | ||
| evidence | ||
| history | ||
| intakes | ||
| registry | ||
| scripts | ||
| spec | ||
| tests | ||
| workplans | ||
| .custodian-brief.md | ||
| .dockerignore | ||
| .gitignore | ||
| .repo-classification.yaml | ||
| AGENTS.md | ||
| CLAUDE.md | ||
| Containerfile | ||
| INTENT.md | ||
| layer.yaml | ||
| LICENSE | ||
| Makefile | ||
| pyproject.toml | ||
| README.md | ||
| SCOPE.md | ||
| TamqMessagingIntroduction.md | ||
| tenancy.yaml | ||
| WORK-RECORDS.md | ||
Reliable multi-tenant auto setup audit capability
Production on railiance01 (AUDIT-WP-0005): PostgreSQL custody, digest-pinned
image, operator procedures in
docs/operator-runbook.md. Manifests live in
deploy/.
Backend contract
The pluggable backend interface, event schema (audit-core.event.v1alpha1),
retention policy, and migration path from the mock file backend are documented
in docs/audit-backend-contract.md.
Development Mock Backend
The first implementation is intentionally tiny: a replaceable audit interface with a mock file backend.
By default it writes JSONL audit events to:
/tmp/audit-core/audit-YYYYMMDDTHH.jsonl
Files older than 7 days are removed when the backend writes or when cleanup is run explicitly. This backend is for local integration and bootstrap wiring. It is not durable audit custody.
Example:
python3 -m audit_core emit \
--source openbao \
--action openbao.authenticated_readiness_proof \
--resource openbao/openbao-0 \
--outcome success \
--detail file_audit_visible=true \
--detail backend=mock-file
Cleanup:
python3 -m audit_core cleanup
Make targets:
make test
make mock-audit-smoke
make mock-audit-cleanup
Environment:
AUDIT_CORE_MOCK_DIR: override the output directory.AUDIT_CORE_MOCK_RETENTION_DAYS: override the default 7-day cleanup window.