tegwick
a2d84bdd9b
Written against draft-7, which landed after the task was drafted and moved the target. Decision 5.4 fixes the location at tenancy.yaml in the repo root rather than docs/, and fixes the schema: current, target, reviewed, gap, placement_exceptions, service_class, per-path detail, provider block. Declares I1 A2 E1 P1 R1. E is quoted at 1 although T04 put the E2 mechanism on both paths, because §13.2 states a passing CI run is not E2 evidence -- the artifact is adversarial, compares separate tenant contexts and carries a review date. Our cross-tenant tests are mechanical, so under §13.1 the level is not claimable until T05. The mechanism is recorded in paths.E and the reason in gap.E. Claiming E2 off unit tests would be the overclaim §6 prohibits, and refusing that reasoning is what found the read-path defect. R stays at 1: R2 needs backupRetentionDays in rapp-postgres's consumer file, requested in T02 and not ours to declare. Two additions draft-7 forced. A credentials gap under Decision 9.2 -- our own finding, adopted as a rule, and it binds us: ingest credentials are static long-lived bearer tokens, declared as a stated gap rather than a silent exclusion. And a provides block under Decision 5.5, declaring what a sender can reach through this service: E2 now, E3 pending ADR-0003, E4 and R4 unreachable. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
109 lines
4 KiB
YAML
109 lines
4 KiB
YAML
schema: info-tech-canon.interface-card.v1
|
|
id: audit-core/interface-card
|
|
title: audit-core Canon Interface Card
|
|
consumer: audit-core
|
|
consumer_profile:
|
|
repo: audit-core
|
|
domain: infotech
|
|
owner: audit-core
|
|
intent: >
|
|
Provide durable, tenant-aware operational custody for audit events so
|
|
senders can treat a 202 as evidence-in-store, not a log-forwarding hint.
|
|
scope:
|
|
- audit event ingestion
|
|
- append-only operational custody
|
|
- sender binding
|
|
- recovery bound to platform backup
|
|
purposes:
|
|
- id: audit-core/operational-custody
|
|
use_case: Accept normalized events from registered senders and retain them in an append-only store.
|
|
consumer_need: A joinable operations.audit provision with an honest recovery claim.
|
|
demand_signals:
|
|
- user-engine delivers platform and tenant events over POST /v1/events
|
|
- neighbours already require data.backup in ITC-CAP terms
|
|
canon_surfaces:
|
|
- model/capability
|
|
- model/governance
|
|
- model/data
|
|
- model/security
|
|
surfaces:
|
|
implemented_profiles: []
|
|
consumed_artifacts:
|
|
- model/capability
|
|
- model/governance
|
|
- model/data
|
|
- model/security
|
|
owned_concepts: []
|
|
produced_concepts:
|
|
- Evidence
|
|
- AuditRecord
|
|
consumed_concepts:
|
|
- Evidence
|
|
- EvidenceBasis
|
|
- CapabilityProvision
|
|
- RetentionRuleReference
|
|
mappings:
|
|
- from: stored event
|
|
to: Evidence / AuditRecord
|
|
note: This service stores evidence. It is not an independent Audit-as-assessment.
|
|
- from: capability.audit.event-retain
|
|
to: operations.audit
|
|
note: data/capability/audit-core-operational.json
|
|
validation_expectations:
|
|
commands:
|
|
- PYTHONPATH=src python3 -m info_tech_canon capability-review /home/worsch/audit-core/data/capability/audit-core-operational.json
|
|
evidence_required:
|
|
- data/capability/audit-core-operational.json
|
|
- docs/operator-runbook.md Restore section
|
|
- docs/evidence/restore-walk-20260813T121200Z.json
|
|
known_gaps:
|
|
- id: data.archive-unprovided
|
|
owner: audit-core
|
|
disposition: unmet requirement recorded on the ITC-CAP case; do not build the sink in AUDIT-WP-0006
|
|
- id: tamper-evidence-false
|
|
owner: audit-core
|
|
disposition: closed by AUDIT-WP-0007; proof bound is in docs/integrity.md
|
|
- id: no-hash-chain
|
|
owner: audit-core
|
|
disposition: INTENT residual, not this workplan
|
|
- id: single-sender
|
|
owner: audit-core
|
|
disposition: NetworkPolicy admits user-engine only; other sources remain adapters
|
|
- id: no-rapp-yaml
|
|
owner: railiance-master
|
|
disposition: schema requires rapp-*; extraction is a first-wave family decision
|
|
- id: historic-archive-overclaim
|
|
owner: audit-core
|
|
disposition: closed by AUDIT-WP-0006-T01; /readyz reports operational
|
|
purpose_fit:
|
|
state: partial
|
|
matched_capabilities:
|
|
- operations.audit
|
|
scope_pressure: >
|
|
INTENT describes a control plane, object archive, hot search, and export.
|
|
The live service is a single-sender operational custody receiver.
|
|
recommended_disposition: keep the operational provision honest; do not inflate to data.archive
|
|
consumer_needs:
|
|
current:
|
|
- Honest custody_class and recoverable window on /readyz
|
|
- Joinable operations.audit provision
|
|
requested_extensions:
|
|
- data.archive sink if events must survive past the 30-day backup window
|
|
feedback: []
|
|
tenancy_posture:
|
|
declared_at: tenancy.yaml
|
|
framework: net-kingdom/canon/standards/tenancy-posture_v0.1.md (draft-7)
|
|
current: I1 A2 E1 P1 R1
|
|
target: I1 A2 E3 P1 R2
|
|
provides_reachable:
|
|
E2: now
|
|
E3: not yet — needs rapp-postgres ADR-0003 GUC contract; target 2027-03-31
|
|
E4: unreachable — one database, one runtime credential, no per-tenant substrate
|
|
R4: unreachable by design — see Decision 4.5.3 and docs/erasure-and-audit.md
|
|
known_deviations:
|
|
- no data.archive sink
|
|
- tamper_evidence is a hash chain plus external head, not WORM
|
|
- no hash-chain
|
|
- single sender user-engine
|
|
- no rapp.yaml (not a rapp-* repo)
|
|
- /readyz historically overclaimed archive (closed by T01)
|