audit-core/workplans/AUDIT-WP-0008-tenancy-posture-alignment.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	depends_on
AUDIT-WP-0008	workplan	Tenancy posture declaration and read-path enforcement	infotech	audit-core	proposed	claude	railiance	2026-08-17	2026-08-17	AUDIT-WP-0007

AUDIT-WP-0008 — Tenancy posture declaration and read-path enforcement

Goal

Answer the rapp-postgres review request against NetKingdom Tenancy Posture v0.1, declare an accurate posture vector, and close the one gap the assessment exposed in running code.

Canonical framework: net-kingdom/canon/standards/tenancy-posture_v0.1.md (rendered copy in policy-nexus/build/tenancy-posture.html).

Assessment — what the ladders say about us

rapp-postgres guessed audit-core I2 A3 E2 P1 R1, and §5 carries that guess as a worked example. Three of the five are too high.

Axis	Guess	Actual	Why
I	2	1	Senders hold static bearer tokens (audit_core/senders.py); the tenant arrives in the request body (audit_core/ingestion.py:379) and is checked against an allowlist bound to the credential. No IdP, no verified claim. §4.1 names this case explicitly: I1 absorbs "the tenant is taken from the request rather than from a verified token".
A	3	2	No flex-auth call exists anywhere in the repo. Authorization is a single local boundary — permits_source, permits_tenant, may_write, may_read. That is the definition of A2.
E	2	1	The write path is E2-shaped. The read path applies no tenant filter at all. See below.
P	1	1	platform-pg, database per consumer. Correct.
R	1	1	No backupRetentionDays in rapp-postgres/consumers/audit-core.yaml; platform default 30 days applies. Correct.

The I-axis correction is not a defect. The credential→tenant allowlist is a real control; it is simply an A-axis control sitting where a reader would expect an I-axis one. Decision 3.1 doing its job on its first live use.

The E-axis finding

_read (audit_core/ingestion.py:226-272) gates on identity.may_read and nothing else. permits_tenant is never called on the read path. A credential with may_read: true can read any tenant's events through /v1/events?correlation_id=, /v1/events/<id>, /v1/dead-letters and /v1/secret-findings.

Exposure today is bounded: the production sender user-engine carries may_read: false, and the read surface is ClusterIP behind a default-deny NetworkPolicy. But bounded-by-deployment is not enforced-by-code, and under §6 declaring E2 on that basis would be the overclaim the framework exists to prohibit. E1 is the honest reading until T04 lands.

This also corrects the premise of the review request. rapp-postgres wrote "you are at E2, and E3 is more urgent for you than for anyone else". E3 is indeed the right target for a service holding audit evidence, but §4.3 requires the E2 evidence artifact alongside any E3 claim — so the first move is reaching E2, not adopting RLS.

Positions to take

On the retention ceiling (their question 1)

The 365-day ceiling is not wrong for us. Keep it.

The ADR-0002 context line — "audit-core holds audit evidence and may need years" — is right about the requirement and wrong about the mechanism. Physical backup retention is not where multi-year audit custody belongs. It is already routed: data/capability/audit-core-operational.json records data.archive as an unmet requirement with a separate owner and an explicitly different bucket and lifecycle from Barman.

Consequences we accept and want stated back:

• audit-core declares nothing above the 30-day platform default. We therefore do not extend any co-resident's erasure horizon, now or under this plan.
• Multi-year retention is an archive procurement question, not a WAL-window question. Raising the ceiling would buy us nothing and cost every co-resident volume against 20Gi.
• Service class batch is correct. No correction wanted. Co-residency with latency-critical tenant-engine is right to be reported under §8.3.3.

Ask of rapp-postgres: amend the ADR-0002 opening context to point at archive rather than at backup retention, so the two statements agree.

On erasure versus audit (their question 11)

Yes to the fact/payload split — retain the fact of an event, encrypt its personal payload per subject, shred the key. But that resolution does not survive contact with our integrity design as built, in two ways the framework does not currently capture.

One: it is not retrofittable. _record_hash (audit_core/postgres_backend.py:583) is SHA-256 over the canonical JSON of the cleartext record, and that hash is what the chain commits to. Encrypting a payload after the fact severs the binding between payload_hash and the stored record. Shreddability has to be built as encrypt-then-hash at accept time, with the chain committing to ciphertext. Retrofitting it onto existing events is not possible without rewriting the chain, which is the one thing AUDIT-WP-0007 was built to make detectable.

Two, and sharper: the retained hash is a confirmation oracle. A SHA-256 over a canonical record whose fields are low-entropy (event type, actor, tenant, subject, timestamp) lets anyone holding the hash guess the payload, hash the guess, and confirm a match. Destroying the key does not make the content unrecoverable while that hash survives. Crypto-shredding does not reach R4 under this design. It needs the integrity commitment to be an HMAC under a per-subject key that dies with the key, or a per-record salt destroyed with it.

This is a genuine gap in §4.5, not just a fact about us: the key-destroyed route treats key destruction as sufficient without requiring that no retained commitment reveal the erased content. Recommend §4.5 gain that condition.

Our position: audit-core targets R2, not R4. Verified erasure of audit evidence is a design tension we record rather than resolve, and a "R4 everywhere" fleet target must exempt this service explicitly.

Framework review findings

Sent under §20.2 — the framework is validated by whether it can describe us.

1. The E ladder cannot express asymmetric enforcement. Our write path is E2 and our read path is E1. §4.3 assumes one level per service. This will recur estate-wide, since most services enforce harder on write than on read, and with no rule everyone will declare their best path. Recommend the vector take the minimum across paths, stated explicitly — the reading consistent with §6. Per-path declaration (E: {write: 2, read: 1}) is the richer option but invites the same selective quoting downstream.

2. §13.1 collides with the ladder floor. "A level is claimed only with its evidence artifact present", but §13's table has no artifact for I0, I1, A0, A1, E0, E1, R0 or R1. §5's own worked example of a conformant absorbed repo — I1 A1 E1 P0 R0 — cannot satisfy 13.1 on any axis. Either declaration alone is the evidence at the floor rungs, or 13.1 binds only above them. Small, but it makes the framework's flagship example non-conformant against its own rule.

3. §9.1 omits consumer-facing credentials. Decision 9.1 bans static long-lived credentials for database access above E0, and we comply — leases re-read at connection time, audit_core/credentials.py. But our ingest credentials are static long-lived bearer tokens rotated by publishing a second token alongside the first. §9 promotes leased credentials to "a tenancy control"; the same argument applies with more force to the credential that actually carries the tenant claim. The omission reads as accidental. Name consumer-facing credentials in scope, or say deliberately that they are not.

4. §4.5 key-destroyed route — add the condition in "On erasure versus audit" above: no retained integrity commitment may reveal the erased content.

5. §5 worked example — correct audit-core to I1 A2 E1 P1 R1, and revise its note. "Both E3 and R2 are urgent targets" is half right: E3 is, R2 is nearly vacuous for us while the real requirement sits in data.archive.

Nothing here asks the framework to change shape. Four of five axes described us without strain, and the one that did not (E) failed in a way that found a real defect in our code. That is the framework working.

Non-goals

• E3 / row-level security is not in this plan. ADR-0003 publishes the contract and it is the right target, but it is blocked behind reaching E2 (§4.3) and needs the EXPLAIN comparison first. Declared as target with a recorded gap in T01, not built here.
• No per-subject encryption is built. T03 records a position; it does not commit to an implementation.
• No adversarial evidence facility is built here. §19.3 gave that a home in whitehat-security. T05 coordinates, it does not volunteer.

Tasks

id: AUDIT-WP-0008-T01
status: todo
priority: high

Publish the posture vector in the repo per Decision 5.1 — docs/tenancy-posture.yaml, declaring current: I1 A2 E1 P1 R1, target: I1 A2 E3 P1 R2, reviewed date, and a gap note per axis. The E gap names the read path and cites T04; the R gap names data.archive as the real requirement. Cross-link from SCOPE.md and docs/interface-card.yaml.

id: AUDIT-WP-0008-T02
status: todo
priority: high

Reply to rapp-postgres message 56b77e20-0152-4e09-8f76-99640269063b with the retention position: ceiling stays at 365, audit-core declares nothing above the 30-day default, multi-year routes to data.archive, service class batch confirmed. Ask for the ADR-0002 context amendment. Mark the message read on send.

id: AUDIT-WP-0008-T03
status: todo
priority: high

Answer question 11 in docs/erasure-and-audit.md: the fact/payload split, the encrypt-then-hash constraint, the confirmation-oracle finding, and the R2-not-R4 target. Record as an audit-core position; send the §4.5 condition to NetKingdom as a framework amendment.

id: AUDIT-WP-0008-T04
status: todo
priority: high

Bind the read path to permitted tenants. permits_tenant governs read as it governs write, at the same choke point: tenant-scope /v1/events, /v1/events/<id>, /v1/dead-letters and /v1/secret-findings. Decide and record how an operator identity holding tenants: ["*"] is distinguished from a scoped reader. Tests for cross-tenant read refusal. Update docs/interface-card.yaml and the operator runbook. Raises E to 2 on both paths; update T01's declaration.

id: AUDIT-WP-0008-T05
status: todo
priority: medium

Produce the §13 E2 evidence artifact — adversarial, with a review date: an identity bound to tenant A demonstrably cannot read tenant B. Coordinate with whitehat-security (WHITEHAT-WP-0001) on whether this is theirs to run or ours to write and theirs to review. Record the review cadence as the exposure window per §19.3.

id: AUDIT-WP-0008-T06
status: todo
priority: medium

Send the five framework review findings to net-kingdom (owner of the canon path) and policy-nexus (owner of the rendered copy), as a §20.2 review response rather than as objections.

Done when

• docs/tenancy-posture.yaml declares an accurate vector with targets and gaps.
• Read path enforces tenant scope, with a test that fails if it regresses.
• rapp-postgres has the retention answer and the question 11 answer.
• NetKingdom has the five framework findings.
• The §5 worked example for audit-core is corrected upstream.