tegwick
ded432a63f
Postgres now reports custody_class=operational with a cited 30-day recoverable window. Join ITC-CAP operations.audit at D4, publish the interface card, and overlay user-engine tenants [*] from Git so an ExternalSecret refresh cannot shrink it.
99 lines
3.5 KiB
YAML
99 lines
3.5 KiB
YAML
schema: info-tech-canon.interface-card.v1
|
|
id: audit-core/interface-card
|
|
title: audit-core Canon Interface Card
|
|
consumer: audit-core
|
|
consumer_profile:
|
|
repo: audit-core
|
|
domain: infotech
|
|
owner: audit-core
|
|
intent: >
|
|
Provide durable, tenant-aware operational custody for audit events so
|
|
senders can treat a 202 as evidence-in-store, not a log-forwarding hint.
|
|
scope:
|
|
- audit event ingestion
|
|
- append-only operational custody
|
|
- sender binding
|
|
- recovery bound to platform backup
|
|
purposes:
|
|
- id: audit-core/operational-custody
|
|
use_case: Accept normalized events from registered senders and retain them in an append-only store.
|
|
consumer_need: A joinable operations.audit provision with an honest recovery claim.
|
|
demand_signals:
|
|
- user-engine delivers platform and tenant events over POST /v1/events
|
|
- neighbours already require data.backup in ITC-CAP terms
|
|
canon_surfaces:
|
|
- model/capability
|
|
- model/governance
|
|
- model/data
|
|
- model/security
|
|
surfaces:
|
|
implemented_profiles: []
|
|
consumed_artifacts:
|
|
- model/capability
|
|
- model/governance
|
|
- model/data
|
|
- model/security
|
|
owned_concepts: []
|
|
produced_concepts:
|
|
- Evidence
|
|
- AuditRecord
|
|
consumed_concepts:
|
|
- Evidence
|
|
- EvidenceBasis
|
|
- CapabilityProvision
|
|
- RetentionRuleReference
|
|
mappings:
|
|
- from: stored event
|
|
to: Evidence / AuditRecord
|
|
note: This service stores evidence. It is not an independent Audit-as-assessment.
|
|
- from: capability.audit.event-retain
|
|
to: operations.audit
|
|
note: data/capability/audit-core-operational.json
|
|
validation_expectations:
|
|
commands:
|
|
- PYTHONPATH=src python3 -m info_tech_canon capability-review /home/worsch/audit-core/data/capability/audit-core-operational.json
|
|
evidence_required:
|
|
- data/capability/audit-core-operational.json
|
|
- docs/operator-runbook.md Restore section
|
|
- docs/evidence/restore-walk-20260813T121200Z.json
|
|
known_gaps:
|
|
- id: data.archive-unprovided
|
|
owner: audit-core
|
|
disposition: unmet requirement recorded on the ITC-CAP case; do not build the sink in AUDIT-WP-0006
|
|
- id: tamper-evidence-false
|
|
owner: audit-core
|
|
disposition: integrity_verification hook is unknown; trigger is not a proof
|
|
- id: no-hash-chain
|
|
owner: audit-core
|
|
disposition: INTENT residual, not this workplan
|
|
- id: single-sender
|
|
owner: audit-core
|
|
disposition: NetworkPolicy admits user-engine only; other sources remain adapters
|
|
- id: no-rapp-yaml
|
|
owner: railiance-master
|
|
disposition: schema requires rapp-*; extraction is a first-wave family decision
|
|
- id: historic-archive-overclaim
|
|
owner: audit-core
|
|
disposition: closed by AUDIT-WP-0006-T01; /readyz reports operational
|
|
purpose_fit:
|
|
state: partial
|
|
matched_capabilities:
|
|
- operations.audit
|
|
scope_pressure: >
|
|
INTENT describes a control plane, object archive, hot search, and export.
|
|
The live service is a single-sender operational custody receiver.
|
|
recommended_disposition: keep the operational provision honest; do not inflate to data.archive
|
|
consumer_needs:
|
|
current:
|
|
- Honest custody_class and recoverable window on /readyz
|
|
- Joinable operations.audit provision
|
|
requested_extensions:
|
|
- data.archive sink if events must survive past the 30-day backup window
|
|
feedback: []
|
|
known_deviations:
|
|
- no data.archive sink
|
|
- tamper_evidence=False
|
|
- no hash-chain
|
|
- single sender user-engine
|
|
- no rapp.yaml (not a rapp-* repo)
|
|
- /readyz historically overclaimed archive (closed by T01)
|