tegwick
2f7f475e85
The Postgres backend returned tamper_evidence=True as a constant while docs/integrity.md permits the claim only when a live external chain-head attestation exists. The one attestation on record is 2026-08-16 and no job renews it, so audit-core was telling every sender it had a property whose precondition was unverified — the §9.6 defect it twice corrected in gate-house's doctrine, turned inward. evaluate_tamper_evidence() derives the flag from the chain report and the mounted attestation, distinguishing seven states. Absence, staleness, mismatch, an undated or unreadable attestation, a chain break, and an unwalkable chain all degrade the claim rather than leave it standing. Unreadable is treated as absent on purpose: a malformed file must not hold up a claim a missing file would drop. The freshness window is 168h against an intended daily cadence — seven cadences, so a handful of missed runs degrade the claim rather than a single one flapping it. Window and cadence are one contract in docs/integrity.md. Production /readyz will now report tamper_evidence: false until AUDIT-WP-0009-T02 schedules attestation. The claim was already false; it now says so. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0185wifnLzCxjEY2MT1XbK7L Assistant: claude-code Assistant-Model: opus Assistant-Process: 713962@bnt-lap001 Assistant-Session: 2718d99d-d3ff-478f-83a2-3a30f01a02fc
117 lines
5.1 KiB
Markdown
117 lines
5.1 KiB
Markdown
# SCOPE
|
|
|
|
Boundary contract for `audit-core`, aligned to NetKingdom Security Layer Model
|
|
v0.7 (accepted) and its working companion. `INTENT.md` says what Audit Core is
|
|
for; this file says what it does and does not do, and is the file to check
|
|
before adding a surface.
|
|
|
|
## One-liner
|
|
|
|
The estate's Evidence engine: durable, tenant-aware custody of audit events,
|
|
with an honest and bounded integrity claim.
|
|
|
|
## Layer and role
|
|
|
|
**Engine / Evidence** (statute §3.3, §4). Deterministic API over one modeled
|
|
concept — the audit event. Declared in `INTENT.md` frontmatter and `layer.yaml`.
|
|
|
|
Audit Core is **not** a PDP, not a PIP, and not PEP-shaped. It renders no
|
|
decision, supplies no claim a decision consumes, and causes no protected side
|
|
effect of its own.
|
|
|
|
## In Scope
|
|
|
|
**Custody and integrity**
|
|
|
|
- Event ingestion, validation, normalization to the Audit Core envelope,
|
|
redaction, and append-only operational custody.
|
|
- Sender registration and binding; tenant and scope attribution.
|
|
- Hash-chain integrity: link, verify, chain-head attestation, and the
|
|
`GET /v1/integrity` operator surface.
|
|
- The honest custody claim — `custody_class`, `immutable`, `tamper_evidence`,
|
|
`recoverable_days` — stated at no more than `docs/integrity.md` delivers.
|
|
- Retention profiles, search and export entitlements, dead-letter and
|
|
secret-finding surfaces.
|
|
|
|
**Evidence-role obligations under v0.7 §9.6** *(largely not yet built — see
|
|
`workplans/AUDIT-WP-0009-evidence-role-conformance.md`)*
|
|
|
|
- Recording, per source, whether its evidence is **load-bearing** or
|
|
**attributive**, because the obligations differ.
|
|
- Accepting and storing a source's declared **emission cadence**, and raising a
|
|
finding when the stream falls below it — the stream observed, not only its
|
|
contents.
|
|
- **Heartbeat** ingestion and missing-heartbeat findings for low-volume
|
|
load-bearing classes, where rate monitoring cannot work.
|
|
- A **reconciliation** surface: per-source, per-class event counts a source can
|
|
compare against its own state transitions.
|
|
- Registering `approval-engine` as a distinct source carrying issuance, use,
|
|
supersession, and revocation (§9.4, `AUDIT-IN-0001`).
|
|
|
|
**Conformance**
|
|
|
|
- Machine-readable layer declaration (`layer.yaml`) and a conformance test.
|
|
- A total list of infrastructure contacts, catalogued or not, so the §5 check
|
|
is total rather than vacuous.
|
|
|
|
## Out of Scope
|
|
|
|
**Boundaries fixed by the statute — these are permanent, not "not yet"**
|
|
|
|
- **Any authorization decision.** `access-engine` is the only decision point
|
|
(§6). Audit Core renders and caches none.
|
|
- **An approval-validity query.** Records, yes; a verdict on whether an approval
|
|
is still valid, never (§9.4). A consumer branching on such an answer would
|
|
route an authorization decision through the audit fabric.
|
|
- **Operative approval state** — the durable object, atomic supersession, single
|
|
consumption, revocation. That is `approval-engine`'s (§9.4).
|
|
- **Emission atomicity at the source.** Completeness at the boundary is the
|
|
emitter's obligation; an archive cannot retrofit it (§9.6).
|
|
- **Any claim that the archive proves an event occurred, or that absence proves
|
|
it did not** (§9.6).
|
|
- **Policy decision making**, per `INTENT.md`.
|
|
|
|
**Not owned here**
|
|
|
|
- Procuring or operating S3 / Barman / WAL; the `platform:audit-storage` booked
|
|
cost or a second usage stream.
|
|
- WORM, object lock, or ITC-CAP `data.archive`. Ruled a different store with a
|
|
different owner (statute §16); the stronger-custody gap is withdrawn, not
|
|
pending.
|
|
- A `rapp.yaml` in this repo (schema requires `rapp-*`).
|
|
- Public ingest.
|
|
- Unrelated adjacent systems; irreversible operational decisions without human
|
|
approval.
|
|
|
|
## Current State
|
|
|
|
- Status: production. Receiver on railiance01 (`namespace audit-core`), Postgres
|
|
operational custody on `platform-pg`, sender `user-engine`.
|
|
- Recovery is the platform `data.backup` window (30 days). `/readyz` reports
|
|
`custody_class=operational`, `recoverable_days=30`.
|
|
- Hash chain verified on 30 live events
|
|
(`docs/evidence/chain-head-20260816.json`).
|
|
- ITC-CAP case: `data/capability/audit-core-operational.json` at D4.
|
|
- Tenancy posture: `tenancy.yaml` — declared `I1 A2 E1 P1 R1`, target `E3`/`R2`.
|
|
|
|
**Known conformance gaps** (assessed 2026-08-29,
|
|
`history/2026-08-29-v0.7-alignment-and-scope-assessment.md`):
|
|
|
|
- ~~`tamper_evidence=True` returned unconditionally by the Postgres backend~~
|
|
**Closed 2026-09-06 (`AUDIT-WP-0009-T01`).** The flag is now derived per
|
|
read from live chain and attestation state against a declared 168h
|
|
freshness window. Until `AUDIT-WP-0009-T02` schedules attestation, the
|
|
honest answer in production is `false` — the overclaim is gone, the
|
|
precondition is not yet met.
|
|
- No cadence, heartbeat, reconciliation, or load-bearing classification exists.
|
|
The §9.6 obligations Audit Core argued for are not yet supportable by Audit
|
|
Core.
|
|
- `approval-engine` is not yet registered as a source.
|
|
- No negative test asserts the absence of an approval-validity surface.
|
|
|
|
## Getting Oriented
|
|
|
|
- Start with: `INTENT.md`, then `net-kingdom/SECURITY-COMPANION.md`
|
|
- Bound on what may be claimed: `docs/integrity.md`
|
|
- Agent instructions: `AGENTS.md`
|
|
- Workplans: `workplans/`
|