coulomb/gate-house
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Bound rule 13: audit proves alteration, not omission

Browse source 
audit-core corrected a claim this repository's doctrine also makes. An
append-only archive with a verified hash chain proves records were not altered
or truncated after arrival; it cannot prove one was never sent. A suppressed
event leaves the chain intact and verification reports intact — and the event
an adversary most wants missing is the negative one: a revocation, a denial, a
containment action.

Adds the bound under the Core Rules, replacing "the audit record proves it
happened" with the sound form, and records that completeness is the emitting
system's obligation via atomic emission.

Flags outstanding doctrine work: the ASM Canon's control §27 and tests T-08 and
T-09 are written as though reconstruction from evidence were unconditional.

Also bumps standard references to v0.4.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2564823@bnt-lap001
Assistant-Session: 2a7ed827-4928-4b9f-8613-9135c9cadfe9
This commit is contained in:
tegwick 2026-08-28 22:55:19 +02:00
parent d62d48aba2
commit 94526e44c0
3 changed files with 24 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

18
INTENT.md
View file

@ -303,6 +303,24 @@ engines and Staff repositories implement them.
14. **Failure of critical policy or authorization dependencies fails closed.**
15. **Production guarantees must survive incorrect agent behavior.**
**A bound on rule 13, and on every claim that rests on audit.** An append-only
archive with a verified hash chain proves records were not *altered or truncated
after arrival*. It cannot prove a record was never sent. A suppressed event
leaves the chain intact and verification reports intact — and the event an
adversary most wants missing is the negative one: a revocation, a denial, a
containment action.
So *"the audit record proves it happened"* is unsound. The sound form is *"the
archive proves the records it holds were not altered or truncated after
arrival"*. Completeness is the emitting system's obligation, discharged by making
emission atomic with the state change; no archive can retrofit it. See
`net-kingdom/canon/standards/security-layer-model_v0.4.md` §9.6, raised by
`audit-core` against its own principle.
This bound is not yet reflected in the Active Secrets Management Canon — control
§27 and tests T-08 and T-09 are written as though reconstruction from evidence
were unconditional. Correcting the Canon is outstanding doctrine work.
---
## Reference Scenarios