audit-core/history/2026-08-29-v0.7-alignment-and-scope-assessment.md

Security layer model v0.7 — alignment, scope revision, and gap assessment

Date: 2026-08-29 Standard: net-kingdom/canon/standards/security-layer-model_v0.7.md — accepted Companion: net-kingdom/SECURITY-COMPANION.md v0.2 Scope of this review: align INTENT.md, revise SCOPE.md, assess scope against intent and against the shipped implementation, and raise the work. Result: INTENT.md and SCOPE.md updated; nine gaps found, one of them a live overclaim; AUDIT-WP-0009 raised.

---

1. Disposition of audit-core's v0.6 findings

All three landed in v0.7:

v0.6 finding	v0.7
atomicity closes accidental, not adversarial, omission	§9.6 gained the three-row threat decomposition, including the explicit nothing in this model prevents it residual
cadence is a SHOULD and is the only control in its class	§9.6 cadence is MUST for load-bearing sources, with positive reconciliation or a heartbeat as the required form for low-volume classes
§3.3's Evidence row states a trade as a property	restated as an estate trade, leaving independent-recording-before-effect raisable as a declared exception

The standard is now accepted. What follows is not review of gate-house's text but assessment of audit-core against it.

2. What v0.7 binds audit-core to

Audit Core is Engine / Evidence (§3.3, §4). Its obligations:

1. Declare the layer in INTENT.md frontmatter plus prose in its own voice (§11, companion §2). layer.yaml alone does not discharge this.
2. Render and cache no decision; expose no approval-validity query (§6, §9.4).
3. Never claim more than the archive delivers, in either direction (§9.6).
4. Support the §9.6 obligations it argued for: the load-bearing/attributive distinction, declared emission cadence, and reconciliation or heartbeat for low-volume load-bearing classes.
5. Register approval-engine as a distinct source (§9.4, AUDIT-IN-0001).
6. Keep the §5 conformance check total by listing infrastructure contacts even where uncatalogued (companion §4), noting that carve-out sunsets within two review intervals.

Point 4 is the one with teeth. audit-core argued cadence up from SHOULD to MUST and specified the reconciliation form. A source cannot declare a cadence to a system with nowhere to put it. Having won the obligation, audit-core owes the surface that makes it dischargeable.

3. Scope versus intent

SCOPE.md was a statehub register stub — "audit-core exists to provide the capability described in INTENT.md" — carrying no boundary at all. Against an INTENT.md that had grown a Layer section, an Approval Evidence section, and a corrected principle 6, the gap was total: every statute-fixed prohibition lived only in INTENT and none of it in SCOPE, which is the file a contributor checks before adding a surface.

SCOPE.md is rewritten to carry the permanent boundaries explicitly — no decision, no validity query, no operative approval state, no completeness claim — and to separate them from the merely-not-yet. The distinction matters: §16 ruled the stronger-custody gap closed, so WORM and data.archive are now not ours rather than not yet, and the old scope line implying a pending archive requirement was stale.

Intent and scope now agree. The disagreement that remains is between both of them and the code.

4. Gaps

G1 — tamper_evidence is claimed unconditionally (headline)

audit_core/postgres_backend.py:306 returns tamper_evidence=True as a constant. docs/integrity.md permits that claim only when:

1. verify exists and fails on a rewritten row; and
2. an external head attestation exists, and verify-against-attestation reports a missing cited head as a break.

Condition 2 is operational, not structural. The only attestation on record is docs/evidence/chain-head-20260816.json — thirteen days old — and deploy/ contains no job that renews it. Every sender reading /readyz is therefore told audit-core has a property whose precondition is unverified and probably stale.

This is §9.6's defect turned inward: audit-core claiming more than its bound delivers, in the exact idiom it corrected in gate-house's own doctrine twice. It is the highest-priority gap for that reason, independent of severity.

Fix: derive the flag from live attestation state, and make a stale or absent attestation degrade the claim rather than leave it standing.

G2 — no load-bearing / attributive classification

SenderIdentity (audit_core/senders.py:30) carries sources, tenants, may_write, may_read, secret_policy, expires_at. Nothing records which kind of evidence a source produces, so audit-core cannot tell which sources owe a cadence. §9.6's central distinction is unrepresentable.

G3 — no cadence declaration

Nothing accepts, stores, or evaluates a declared emission cadence. grep for cadence across audit_core/, docs/, and tests/ returns nothing; the reconcile hits are duplicate-event reconciliation, an unrelated concept. Depends on the §17 emission-cadence schema, which kings-guard is drafting.

G4 — no heartbeat, and no missing-heartbeat finding

The required form for low-volume load-bearing classes does not exist. This is the gap that matters most substantively: it is the only control covering adversarial omission for exactly the rare negative events — revocations, denials, containment — where suppression is most valuable and least visible.

G5 — no reconciliation surface

A source cannot compare its own state transitions against audit-core's event count per class, because no endpoint exposes those counts. GH-WP-0002-T04 is the reference instance and has no counterpart here.

G6 — stream-completeness findings have no home

/v1/dead-letters and /v1/secret-findings exist; a stream-observation finding has no surface. INTENT principle 10 already says degraded audit streams are themselves audit and operations events — the principle is in place and the mechanism is not.

G7 — approval-engine not registered

Committed to in AUDIT-IN-0001. Needs sender registration, the four event classes, tenancy mapping, retention profile, and secret_policy, onboarded under principle 4 — declared policy, not merely arriving events. Not blocking: approval-engine is not yet emitting.

G8 — no negative test on the approval-validity prohibition

§9.4's MUST NOT is currently honoured by absence. The estate's own idiom for a published-equals-shipped property is a test (§6.4 obligation 3 requires exactly that of a PEP stance map). A prohibition worth stating is worth asserting.

G9 — Tooling contact list is empty rather than total

layer.yaml declares tooling_contacts: [], true under §5 as written since audit-core is an Engine holding no key-cape or OpenBao client. But companion §4 asks that uncatalogued infrastructure be listed anyway so the check is total, and the carve-out sunsets within two review intervals: platform-pg is a store another layer reads. Listing it now costs nothing and pre-empts the sunset.

5. What is already conforming

Not everything is a gap, and the assessment would be dishonest without this:

• No decision surface exists. The §6 prohibition is met in fact.
• The integrity contract is honest. docs/integrity.md states the proof bound, names the attacker class it does not cover, and explicitly disclaims WORM and data.archive. G1 is a defect in the code's claim, not the document's — the doctrine was right and the implementation drifted from it.
• Custody claims are otherwise sober: custody_class=operational rather than archive, recovery cited to the platform window rather than retention_days.
• Tenant isolation and redaction are built and tested.
• immutable=True is correctly qualified in-code as not a claim against the database owner.

The pattern is worth naming: where audit-core wrote doctrine it was accurate; where a value was hard-coded it drifted optimistic. G1 is the one place the two diverge, and it diverges in the direction the estate is least able to detect.

6. Priority

Gap	Priority	Why
G1 tamper_evidence	high	live overclaim to every sender; audit-core's own doctrine violated inward
G2 classification	high	prerequisite for G3–G5
G4 heartbeat	high	only control covering the adversarial residual for rare events
G3 cadence	medium	blocked on the §17 schema
G5 reconciliation	medium	GH-WP-0002-T04 counterpart
G8 negative test	medium	cheap; closes a MUST NOT by assertion
G6 findings surface	medium	needed for G3/G4 to be actionable
G7 approval-engine source	low	not blocking; no emitter yet
G9 contact list	low	pre-empts a sunset

Raised as AUDIT-WP-0009-evidence-role-conformance.md.