tegwick
2b8c9097ad
A sender may declare closing_classes; nk-bounded-executor declares execution.run.started closed by execution.attribution.receipt within 7200s. GET /v1/stream-findings reports opening_without_closing past the bound, counted from the receiver's accepted_at plus the heartbeat grace allowance; a per-run data.window.not_after tightens but never extends. Identifiers and timing only. The overlay may add or shorten, never remove, rebind or lengthen. Both backends: 403 passed (1 unrelated live-catalog env failure). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 482098@bnt-lap001 Assistant-Session: 9643c95a-a398-4f4a-b56a-6119be4e845e
102 lines
3 KiB
YAML
102 lines
3 KiB
YAML
# Non-secret sender scope (AUDIT-WP-0006-T05). Tokens stay in Secret
|
|
# audit-core-senders. This ConfigMap is the authority for tenants/sources
|
|
# so an ExternalSecret refresh cannot revert user-engine to a single tenant.
|
|
# Keep in lockstep with deploy/senders-scope.json.
|
|
#
|
|
# The overlay only ever applies to a sender the Secret already carries, so an
|
|
# entry here for a sender with no token yet is inert. That is what makes the
|
|
# approval-engine entry safe to land ahead of its credential.
|
|
#
|
|
# secret_policy may be tightened here (redact -> reject) but never relaxed
|
|
# (AUDIT-WP-0018-T02): nk-bounded-executor receipts are kept by hash, so a
|
|
# secret-shaped field must refuse the event rather than be silently masked.
|
|
#
|
|
# closing_classes may be added or their bound shortened here, never removed,
|
|
# rebound or lengthened (AUDIT-WP-0018-T03): a started run with no receipt past
|
|
# the bound is a stream finding.
|
|
#
|
|
# evidence_kind may be raised here (attributive -> load-bearing) but never
|
|
# lowered: a ConfigMap refresh must not be able to drop a source's §9.6
|
|
# atomicity and detection obligations without anyone deciding to.
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: audit-core-senders-scope
|
|
namespace: audit-core
|
|
labels:
|
|
app.kubernetes.io/name: audit-core
|
|
data:
|
|
senders-scope.json: |
|
|
[
|
|
{
|
|
"name": "user-engine",
|
|
"sources": [
|
|
"user-engine"
|
|
],
|
|
"tenants": [
|
|
"*"
|
|
],
|
|
"may_write": true,
|
|
"may_read": false
|
|
},
|
|
{
|
|
"name": "tenant-engine",
|
|
"sources": [
|
|
"tenant-engine"
|
|
],
|
|
"tenants": [
|
|
"*"
|
|
],
|
|
"may_write": true,
|
|
"may_read": false,
|
|
"evidence_kind": "attributive",
|
|
"completeness_trade": "outbox drains after commit, not inside the mutation transaction; declared at tenant-engine/docs/evidence-emission.md"
|
|
},
|
|
{
|
|
"name": "approval-engine",
|
|
"sources": [
|
|
"approval-engine"
|
|
],
|
|
"tenants": [
|
|
"tenant:platform"
|
|
],
|
|
"may_write": true,
|
|
"may_read": false,
|
|
"evidence_kind": "load-bearing"
|
|
},
|
|
{
|
|
"name": "informed-decision",
|
|
"sources": [
|
|
"informed-decision"
|
|
],
|
|
"tenants": [
|
|
"tenant:platform"
|
|
],
|
|
"may_write": true,
|
|
"may_read": false,
|
|
"evidence_kind": "load-bearing",
|
|
"heartbeat_classes": {
|
|
"informed-decision.memo.posed": 86400
|
|
}
|
|
},
|
|
{
|
|
"name": "nk-bounded-executor",
|
|
"sources": [
|
|
"net-kingdom.bounded-executor"
|
|
],
|
|
"tenants": [
|
|
"platform"
|
|
],
|
|
"may_write": true,
|
|
"may_read": false,
|
|
"secret_policy": "reject",
|
|
"evidence_kind": "load-bearing",
|
|
"closing_classes": {
|
|
"execution.run.started": {
|
|
"closed_by": "execution.attribution.receipt",
|
|
"within_seconds": 7200
|
|
}
|
|
}
|
|
}
|
|
]
|