tegwick
c4016a70d5
informed-decision is the browser-facing approver surface; GH-DEC-2026-012 limit 3 makes its evidence copy the one that must reach audit-core independently of the emitter, because there the actor being audited and the evidence source are the same component. Registration accepted on every proposed field — exact source, ["tenant:platform"], write true, read false, load-bearing, secret_policy redact. Prepared and inert: the scope overlay applies only to a sender the Secret already carries, asserted by test rather than by reading. Ingress ANDs namespace and pod label in one peer, following approval-engine rather than user-engine's older breadth. Gate House asked whether the record shape can carry a source-held-content declaration with a retrieval expectation, and asked for a straight answer rather than a rule the storage cannot meet. Both halves, which must travel together: It CAN carry the declaration. data is stored verbatim into details.data and hash-chained, so content_exists and custody need no schema change and become as tamper-evident as the commitment they accompany. It CANNOT detect non-production. audit-core performs no retrieval and its egress permits Postgres and DNS only. Detection happens at retrieval, by the reviewer; the stored declaration is what turns a blank into a failure attributable to the named custodian. Residual stated rather than left to be found: a custodian that never held the content can emit a false content_exists. audit-core validates the declaration's shape, never its truth — the same class as omission at source, and not closed by the chain, by attestation, or by T04/T06. A test asserts no egress to the emitter exists, because that claim silently stops being true if one appears. Cadence: reconciliation plus heartbeat is right for a mixed-volume source, with both scoped per class rather than per source — a per-source heartbeat is satisfied by the high-volume presentation stream and says nothing about a quiet month of dispositions. Bound: a compromised emitter suppresses the event and its own count together. Also recorded: commitment-only satisfies non-alteration and never reconstructability, in this repo's documents as in theirs; and tenant provenance under GH-DEC-2026-013 lands in the registration record, not the envelope, since audit-core checks a value the credential may write rather than resolving an identity claim. No secret was created and no production manifest applied. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Nb7Q6ZmXppNDkTWytfYqfv Assistant: claude-code Assistant-Model: opus Assistant-Process: 2069992@bnt-lap001 Assistant-Session: 167dd7f8-2a25-4be1-aa46-3b6f1a5f94c6
59 lines
1.6 KiB
YAML
59 lines
1.6 KiB
YAML
# Non-secret sender scope (AUDIT-WP-0006-T05). Tokens stay in Secret
|
|
# audit-core-senders. This ConfigMap is the authority for tenants/sources
|
|
# so an ExternalSecret refresh cannot revert user-engine to a single tenant.
|
|
# Keep in lockstep with deploy/senders-scope.json.
|
|
#
|
|
# The overlay only ever applies to a sender the Secret already carries, so an
|
|
# entry here for a sender with no token yet is inert. That is what makes the
|
|
# approval-engine entry safe to land ahead of its credential.
|
|
#
|
|
# evidence_kind may be raised here (attributive -> load-bearing) but never
|
|
# lowered: a ConfigMap refresh must not be able to drop a source's §9.6
|
|
# atomicity and detection obligations without anyone deciding to.
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: audit-core-senders-scope
|
|
namespace: audit-core
|
|
labels:
|
|
app.kubernetes.io/name: audit-core
|
|
data:
|
|
senders-scope.json: |
|
|
[
|
|
{
|
|
"name": "user-engine",
|
|
"sources": [
|
|
"user-engine"
|
|
],
|
|
"tenants": [
|
|
"*"
|
|
],
|
|
"may_write": true,
|
|
"may_read": false
|
|
},
|
|
{
|
|
"name": "approval-engine",
|
|
"sources": [
|
|
"approval-engine"
|
|
],
|
|
"tenants": [
|
|
"tenant:platform"
|
|
],
|
|
"may_write": true,
|
|
"may_read": false,
|
|
"evidence_kind": "load-bearing"
|
|
},
|
|
{
|
|
"name": "informed-decision",
|
|
"sources": [
|
|
"informed-decision"
|
|
],
|
|
"tenants": [
|
|
"tenant:platform"
|
|
],
|
|
"may_write": true,
|
|
"may_read": false,
|
|
"evidence_kind": "load-bearing"
|
|
}
|
|
]
|