tegwick
7728fde9b4
- deploy/senders-scope.{json,yaml}: nk-bounded-executor (source
net-kingdom.bounded-executor, tenants [platform], write-only,
secret_policy reject, load-bearing); inert until a token is seeded
- senders.py: the scope overlay may tighten secret_policy redact->reject,
never relax it
- networkpolicies.yaml: audit-core-nk-bounded-executor-ingress (sso AND
app.kubernetes.io/name=bounded-executor, TCP 8080); not applied
- tests on the executor's envelope shape: 202, 200 duplicate, 409, wrong
source/tenant, secret-shaped step check 400
- T03 unblocked (window bound = admission window.not_after)
- docs: emitter defect: executor AuditCore.emit rejects 202
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
92 lines
2.6 KiB
YAML
92 lines
2.6 KiB
YAML
# Non-secret sender scope (AUDIT-WP-0006-T05). Tokens stay in Secret
|
|
# audit-core-senders. This ConfigMap is the authority for tenants/sources
|
|
# so an ExternalSecret refresh cannot revert user-engine to a single tenant.
|
|
# Keep in lockstep with deploy/senders-scope.json.
|
|
#
|
|
# The overlay only ever applies to a sender the Secret already carries, so an
|
|
# entry here for a sender with no token yet is inert. That is what makes the
|
|
# approval-engine entry safe to land ahead of its credential.
|
|
#
|
|
# secret_policy may be tightened here (redact -> reject) but never relaxed
|
|
# (AUDIT-WP-0018-T02): nk-bounded-executor receipts are kept by hash, so a
|
|
# secret-shaped field must refuse the event rather than be silently masked.
|
|
#
|
|
# evidence_kind may be raised here (attributive -> load-bearing) but never
|
|
# lowered: a ConfigMap refresh must not be able to drop a source's §9.6
|
|
# atomicity and detection obligations without anyone deciding to.
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: audit-core-senders-scope
|
|
namespace: audit-core
|
|
labels:
|
|
app.kubernetes.io/name: audit-core
|
|
data:
|
|
senders-scope.json: |
|
|
[
|
|
{
|
|
"name": "user-engine",
|
|
"sources": [
|
|
"user-engine"
|
|
],
|
|
"tenants": [
|
|
"*"
|
|
],
|
|
"may_write": true,
|
|
"may_read": false
|
|
},
|
|
{
|
|
"name": "tenant-engine",
|
|
"sources": [
|
|
"tenant-engine"
|
|
],
|
|
"tenants": [
|
|
"*"
|
|
],
|
|
"may_write": true,
|
|
"may_read": false,
|
|
"evidence_kind": "attributive",
|
|
"completeness_trade": "outbox drains after commit, not inside the mutation transaction; declared at tenant-engine/docs/evidence-emission.md"
|
|
},
|
|
{
|
|
"name": "approval-engine",
|
|
"sources": [
|
|
"approval-engine"
|
|
],
|
|
"tenants": [
|
|
"tenant:platform"
|
|
],
|
|
"may_write": true,
|
|
"may_read": false,
|
|
"evidence_kind": "load-bearing"
|
|
},
|
|
{
|
|
"name": "informed-decision",
|
|
"sources": [
|
|
"informed-decision"
|
|
],
|
|
"tenants": [
|
|
"tenant:platform"
|
|
],
|
|
"may_write": true,
|
|
"may_read": false,
|
|
"evidence_kind": "load-bearing",
|
|
"heartbeat_classes": {
|
|
"informed-decision.memo.posed": 86400
|
|
}
|
|
},
|
|
{
|
|
"name": "nk-bounded-executor",
|
|
"sources": [
|
|
"net-kingdom.bounded-executor"
|
|
],
|
|
"tenants": [
|
|
"platform"
|
|
],
|
|
"may_write": true,
|
|
"may_read": false,
|
|
"secret_policy": "reject",
|
|
"evidence_kind": "load-bearing"
|
|
}
|
|
]
|