diff --git a/docs/evidence/2026-10-15-posture-feedback-adoption/adoption.json b/docs/evidence/2026-10-15-posture-feedback-adoption/adoption.json new file mode 100644 index 0000000..2ccaceb --- /dev/null +++ b/docs/evidence/2026-10-15-posture-feedback-adoption/adoption.json @@ -0,0 +1,58 @@ +{ + "workplan": "NK-WP-0031", + "as_of": "2026-10-15T17:27:15Z", + "result": "adoption-complete; E2 expired", + "authority": "Founder requested NK-WP-0031 completion; source metadata published in audit-core/tenancy.yaml. No evaluator remediation writes or live test authorized.", + "source_refs": { + "receipt": "audit-core/docs/evidence/AUDIT-WP-0008-T05-whitehat-e2-03-pass-2026-08-22.md", + "report": "audit-core/docs/evidence/AUDIT-WP-0008-T05-whitehat-e2-03-final-report.json", + "owner_adoption": "audit-core/workplans/ADHOC-2026-10-15.md" + }, + "sha256": { + "source_declaration": "3271f63beb8079bc85e34db83f64b8e0b766ff1e203d4a9958c21e0f7902111e", + "original_declaration": "0f0fa7ba83de6fa822b8ab10121e29c710b9566afa6b9de30340a6263a0dfbba", + "source_receipt": "8210d9e9adfcc0f2e568549b26eca4977176bc05ae234811c9ce45352c5d911c", + "source_report": "2d5a21141b78024a5334881e2b7fd62a69c46931057f77515a6c6f18ec497593" + }, + "reports": { + "before.json": "aee6f364162c3bfc5c4fd52d23f3505e82aa6a490276b3449a9eb15506b637df", + "after.json": "bd53b4920222db5a01269f598d1d9e901c92e5cb9d24f46158fe443008e19d3a", + "fail-on-high.json": "7aa68cd122566a7080acb63dc755ae46fd6cd887f048dbbf37aa60fd4f44cd8d" + }, + "verification": { + "schema_and_semantics": "valid", + "focused_tests": 28, + "repeat_report_byte_identical": true, + "fail_on_high_exit": 1, + "original_posture_evidence_and_review_dates_unchanged": true, + "feedback_external_writes": false + }, + "before": { + "E2": "evidence-freshness-unknown", + "owner": "unknown", + "unknown_owner_findings": 10 + }, + "after": { + "E2": "evidence-expired", + "owner": "audit-core", + "valid_until": "2026-08-23T22:10:25Z", + "unknown_owner_findings": 0, + "high_findings": 2, + "declared_gaps": 8 + }, + "residual": { + "workplan": "AUDIT-WP-0015", + "task": "AUDIT-WP-0015-T02", + "status": "wait", + "scope": "Owner prerequisites and fresh approved E2 engagement; old engagements remain terminal. Posture review remains overdue, E2 remains expired." + }, + "knowledge": { + "version": "0.2.6", + "digest": "8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02", + "cards": [ + "start", + "evidence" + ], + "status": "withheld/orientation-only; directly reviewed cards and current source evidence and owner instructions" + } +} diff --git a/docs/evidence/2026-10-15-posture-feedback-adoption/after.json b/docs/evidence/2026-10-15-posture-feedback-adoption/after.json new file mode 100644 index 0000000..d7a8721 --- /dev/null +++ b/docs/evidence/2026-10-15-posture-feedback-adoption/after.json @@ -0,0 +1,147 @@ +{ + "apiVersion": "netkingdom.io/posture-feedback/v0.1", + "as_of": "2026-10-15T17:27:15Z", + "automation": { + "declaration_mutation_permitted": false, + "external_write_permitted": false, + "mode": "proposal-only", + "policy_mutation_permitted": false + }, + "fail_on": "none", + "findings": [ + { + "class": "declared-gap", + "control": "A", + "evidence_state": "gap", + "id": "NKFB-f99aef50e23cb685", + "owner": "audit-core", + "reason": "A2 is accurate. Authorization is a single local boundary \u2014 permitted sources, permitted tenants, may_write, may_read \u2014 bound once and centrally. No flex-auth delegation. A3 is not a near-term target: flex-auth is itself at A0 on its own self-report (/v1/check authenticates no caller), so delegating to it today would lower this service's assurance, not raise it.", + "recommended_action": "Review the declared A-axis gap and retain, schedule, or resolve it explicitly.", + "service": "audit-core", + "severity": "low", + "source": "audit-core/tenancy.yaml" + }, + { + "class": "declared-gap", + "control": "E", + "evidence_state": "gap", + "id": "NKFB-799293aa994f85a0", + "owner": "audit-core", + "reason": "E2 is implemented on both paths by AUDIT-WP-0008-T04 and evidenced by the bounded whitehat-security target run WH-ENG-20260822-AUDIT-E2-03. An ordinary tenant-A identity could not fetch tenant B's event by id, observe tenant B's correlation fixture, or append as tenant B across ten attempted operations. The run ended 2026-08-22T22:10:25Z with no limitations; receipt-bound cleanup removed both temporary identities, both exact KV paths, all projection resources and the runner. This says only that the attempted attacks did not work, not that the boundary always holds. The 24-hour facility baseline makes review or replacement due at 2026-08-23T22:10:25Z, and relevant boundary changes require a pre-promotion run.", + "recommended_action": "Review the declared E-axis gap and retain, schedule, or resolve it explicitly.", + "service": "audit-core", + "severity": "low", + "source": "audit-core/tenancy.yaml" + }, + { + "class": "declared-gap", + "control": "E_target", + "evidence_state": "gap", + "id": "NKFB-383ced837546ffb2", + "owner": "audit-core", + "reason": "E3 (row-level security per rapp-postgres ADR-0003) targeted 2027-03-31. Blocked behind the E2 artifact \u2014 \u00a74.3 requires E2 evidence alongside any E3 claim \u2014 and needs the EXPLAIN comparison first, since RLS disables functional indexes built on non-leakproof functions. E4 is unreachable at P1 by the \u00a73.2 coupling and is not a target.", + "recommended_action": "Review the declared E_target-axis gap and retain, schedule, or resolve it explicitly.", + "service": "audit-core", + "severity": "low", + "source": "audit-core/tenancy.yaml" + }, + { + "class": "declared-gap", + "control": "I", + "evidence_state": "gap", + "id": "NKFB-9fbe41e33385dd8d", + "owner": "audit-core", + "reason": "I1 is accurate and is not currently a target. Senders authenticate with bearer tokens and the tenant arrives in the request body, checked against an allowlist bound to the credential (\u00a74.1 places request-supplied tenant identifiers at I1 however canonical the string). The allowlist is a real control, but it is an A-axis control; it does not make the identity verified. Moving to I2 means senders carrying a verified token with a tenant claim, which is a change to every sender and not audit-core's to make alone. Recorded as accurate, not as ambition.", + "recommended_action": "Review the declared I-axis gap and retain, schedule, or resolve it explicitly.", + "service": "audit-core", + "severity": "low", + "source": "audit-core/tenancy.yaml" + }, + { + "class": "declared-gap", + "control": "R_ceiling", + "evidence_state": "gap", + "id": "NKFB-a0f2e3e263ccc141", + "owner": "audit-core", + "reason": "R4 is unreachable under the current design and is not a target. Per Decision 4.5.3 \u2014 which this repo found \u2014 the hash chain commits to a SHA-256 of the cleartext record, which survives key destruction as a confirmation oracle over low-entropy fields. A fleet R4 target must exempt this service explicitly. See docs/erasure-and-audit.md (AUDIT-WP-0008-T03).", + "recommended_action": "Review the declared R_ceiling-axis gap and retain, schedule, or resolve it explicitly.", + "service": "audit-core", + "severity": "low", + "source": "audit-core/tenancy.yaml" + }, + { + "class": "declared-gap", + "control": "V", + "evidence_state": "gap", + "id": "NKFB-ea951e92dcbbe455", + "owner": "audit-core", + "reason": "V1 evidenced 2026-09-24 (AUDIT-WP-0008-T07). Receiver recreate recovered in about 7 seconds. Recreating the single platform-pg primary recovered the accept path 22 seconds after the pod terminated. The chain stayed intact. Lease revocation and node reboot were not part of the exercise. V2 is not reachable at P1 as built: platform-pg runs instances 1, and Decision 4.6.1 makes V the minimum across synchronous providers, so V1 is the ceiling. Review 2026-12-31.", + "recommended_action": "Review the declared V-axis gap and retain, schedule, or resolve it explicitly.", + "service": "audit-core", + "severity": "low", + "source": "audit-core/tenancy.yaml" + }, + { + "class": "declared-gap", + "control": "credentials", + "evidence_state": "gap", + "id": "NKFB-405c5a50c97cf3ce", + "owner": "audit-core", + "reason": "Stated gap against Decision 9.2 rather than a silent exclusion. Database credentials comply with 9.1: dynamic leases re-read from a mounted Secret at connection time, no restart on rotation. Ingest credentials do not: they are static long-lived bearer tokens, rotated overlap-first by publishing a replacement alongside the incumbent and then dropping the predecessor. audit-core raised this omission during review and is not exempting itself from the rule it asked for. No dated remedy yet; leasing consumer-facing credentials needs a broker path that does not exist.", + "recommended_action": "Review the declared credentials-axis gap and retain, schedule, or resolve it explicitly.", + "service": "audit-core", + "severity": "low", + "source": "audit-core/tenancy.yaml" + }, + { + "class": "declared-gap", + "control": "retention_placement", + "evidence_state": "gap", + "id": "NKFB-fa7016392a1b7029", + "owner": "audit-core", + "reason": "audit-core's INTENT wants unbounded WORM archive. That is data.archive in ITC-CAP terms, recorded as an unmet requirement in data/capability/audit-core-operational.json, and it is deliberately not a backup-window question: a 30-day WAL window is not an archive, is not searchable, and restores instance-wide. Reviewed 2026-12-31. If no data.archive provision is procured by then, audit-core reopens placement under the \u00a74.5 retention trigger, with P2 as the fallback \u2014 a worse answer than archive, named now so it is not improvised later.", + "recommended_action": "Review the declared retention_placement-axis gap and retain, schedule, or resolve it explicitly.", + "service": "audit-core", + "severity": "low", + "source": "audit-core/tenancy.yaml" + }, + { + "class": "evidence-expired", + "control": "E2", + "due": "2026-08-23T22:10:25Z", + "evidence_state": "expired", + "id": "NKFB-ab9248a8ad4d414a", + "owner": "audit-core", + "reason": "Evidence for E2 expired before 2026-10-15T17:27:15Z.", + "recommended_action": "Under AUDIT-WP-0015-T02, obtain the owner-confirmed bounded identities and a new Whitehat engagement with fresh plane admission and exact rules-of-engagement approval; run the cross-tenant E2 probes, complete receipt-bound cleanup, and publish the replacement report and freshness metadata. Prior -01/-02/-03 engagements are terminal and cannot be reused. Re-evaluate after relevant boundary changes before promotion. A later recovery exercise does not renew E2, and this declaration authorizes no live run.", + "service": "audit-core", + "severity": "high", + "source": "audit-core/tenancy.yaml" + }, + { + "class": "posture-review-overdue", + "control": "tenancy-posture", + "due": "2026-08-23", + "evidence_state": "overdue", + "id": "NKFB-cba6591a27598aad", + "owner": "audit-core", + "reason": "tenancy-posture review was due on 2026-08-23 and is overdue at 2026-10-15T17:27:15Z.", + "recommended_action": "Review tenancy-posture, update its declaration and evidence, and retain the review record.", + "service": "audit-core", + "severity": "high", + "source": "audit-core/tenancy.yaml" + } + ], + "horizon_days": 14, + "kind": "PostureFeedbackReport", + "ok": true, + "report_digest": "sha256:64a9c9e86a93e989646f4c614f05d27d8e75cc78f88b80e18aeef0493b91db0a", + "summary": { + "high": 2, + "low": 8, + "medium": 0, + "total": 10, + "unknown_owner": 0 + }, + "validation_errors": [] +} diff --git a/docs/evidence/2026-10-15-posture-feedback-adoption/before.json b/docs/evidence/2026-10-15-posture-feedback-adoption/before.json new file mode 100644 index 0000000..a97ffd9 --- /dev/null +++ b/docs/evidence/2026-10-15-posture-feedback-adoption/before.json @@ -0,0 +1,146 @@ +{ + "apiVersion": "netkingdom.io/posture-feedback/v0.1", + "as_of": "2026-10-15T17:27:15Z", + "automation": { + "declaration_mutation_permitted": false, + "external_write_permitted": false, + "mode": "proposal-only", + "policy_mutation_permitted": false + }, + "fail_on": "none", + "findings": [ + { + "class": "declared-gap", + "control": "A", + "evidence_state": "gap", + "id": "NKFB-f99aef50e23cb685", + "owner": "unknown", + "reason": "A2 is accurate. Authorization is a single local boundary \u2014 permitted sources, permitted tenants, may_write, may_read \u2014 bound once and centrally. No flex-auth delegation. A3 is not a near-term target: flex-auth is itself at A0 on its own self-report (/v1/check authenticates no caller), so delegating to it today would lower this service's assurance, not raise it.", + "recommended_action": "Review the declared A-axis gap and retain, schedule, or resolve it explicitly.", + "service": "audit-core", + "severity": "low", + "source": "audit-core/tenancy.yaml" + }, + { + "class": "declared-gap", + "control": "E", + "evidence_state": "gap", + "id": "NKFB-799293aa994f85a0", + "owner": "unknown", + "reason": "E2 is implemented on both paths by AUDIT-WP-0008-T04 and evidenced by the bounded whitehat-security target run WH-ENG-20260822-AUDIT-E2-03. An ordinary tenant-A identity could not fetch tenant B's event by id, observe tenant B's correlation fixture, or append as tenant B across ten attempted operations. The run ended 2026-08-22T22:10:25Z with no limitations; receipt-bound cleanup removed both temporary identities, both exact KV paths, all projection resources and the runner. This says only that the attempted attacks did not work, not that the boundary always holds. The 24-hour facility baseline makes review or replacement due at 2026-08-23T22:10:25Z, and relevant boundary changes require a pre-promotion run.", + "recommended_action": "Review the declared E-axis gap and retain, schedule, or resolve it explicitly.", + "service": "audit-core", + "severity": "low", + "source": "audit-core/tenancy.yaml" + }, + { + "class": "declared-gap", + "control": "E_target", + "evidence_state": "gap", + "id": "NKFB-383ced837546ffb2", + "owner": "unknown", + "reason": "E3 (row-level security per rapp-postgres ADR-0003) targeted 2027-03-31. Blocked behind the E2 artifact \u2014 \u00a74.3 requires E2 evidence alongside any E3 claim \u2014 and needs the EXPLAIN comparison first, since RLS disables functional indexes built on non-leakproof functions. E4 is unreachable at P1 by the \u00a73.2 coupling and is not a target.", + "recommended_action": "Review the declared E_target-axis gap and retain, schedule, or resolve it explicitly.", + "service": "audit-core", + "severity": "low", + "source": "audit-core/tenancy.yaml" + }, + { + "class": "declared-gap", + "control": "I", + "evidence_state": "gap", + "id": "NKFB-9fbe41e33385dd8d", + "owner": "unknown", + "reason": "I1 is accurate and is not currently a target. Senders authenticate with bearer tokens and the tenant arrives in the request body, checked against an allowlist bound to the credential (\u00a74.1 places request-supplied tenant identifiers at I1 however canonical the string). The allowlist is a real control, but it is an A-axis control; it does not make the identity verified. Moving to I2 means senders carrying a verified token with a tenant claim, which is a change to every sender and not audit-core's to make alone. Recorded as accurate, not as ambition.", + "recommended_action": "Review the declared I-axis gap and retain, schedule, or resolve it explicitly.", + "service": "audit-core", + "severity": "low", + "source": "audit-core/tenancy.yaml" + }, + { + "class": "declared-gap", + "control": "R_ceiling", + "evidence_state": "gap", + "id": "NKFB-a0f2e3e263ccc141", + "owner": "unknown", + "reason": "R4 is unreachable under the current design and is not a target. Per Decision 4.5.3 \u2014 which this repo found \u2014 the hash chain commits to a SHA-256 of the cleartext record, which survives key destruction as a confirmation oracle over low-entropy fields. A fleet R4 target must exempt this service explicitly. See docs/erasure-and-audit.md (AUDIT-WP-0008-T03).", + "recommended_action": "Review the declared R_ceiling-axis gap and retain, schedule, or resolve it explicitly.", + "service": "audit-core", + "severity": "low", + "source": "audit-core/tenancy.yaml" + }, + { + "class": "declared-gap", + "control": "V", + "evidence_state": "gap", + "id": "NKFB-ea951e92dcbbe455", + "owner": "unknown", + "reason": "V1 evidenced 2026-09-24 (AUDIT-WP-0008-T07). Receiver recreate recovered in about 7 seconds. Recreating the single platform-pg primary recovered the accept path 22 seconds after the pod terminated. The chain stayed intact. Lease revocation and node reboot were not part of the exercise. V2 is not reachable at P1 as built: platform-pg runs instances 1, and Decision 4.6.1 makes V the minimum across synchronous providers, so V1 is the ceiling. Review 2026-12-31.", + "recommended_action": "Review the declared V-axis gap and retain, schedule, or resolve it explicitly.", + "service": "audit-core", + "severity": "low", + "source": "audit-core/tenancy.yaml" + }, + { + "class": "declared-gap", + "control": "credentials", + "evidence_state": "gap", + "id": "NKFB-405c5a50c97cf3ce", + "owner": "unknown", + "reason": "Stated gap against Decision 9.2 rather than a silent exclusion. Database credentials comply with 9.1: dynamic leases re-read from a mounted Secret at connection time, no restart on rotation. Ingest credentials do not: they are static long-lived bearer tokens, rotated overlap-first by publishing a replacement alongside the incumbent and then dropping the predecessor. audit-core raised this omission during review and is not exempting itself from the rule it asked for. No dated remedy yet; leasing consumer-facing credentials needs a broker path that does not exist.", + "recommended_action": "Review the declared credentials-axis gap and retain, schedule, or resolve it explicitly.", + "service": "audit-core", + "severity": "low", + "source": "audit-core/tenancy.yaml" + }, + { + "class": "declared-gap", + "control": "retention_placement", + "evidence_state": "gap", + "id": "NKFB-fa7016392a1b7029", + "owner": "unknown", + "reason": "audit-core's INTENT wants unbounded WORM archive. That is data.archive in ITC-CAP terms, recorded as an unmet requirement in data/capability/audit-core-operational.json, and it is deliberately not a backup-window question: a 30-day WAL window is not an archive, is not searchable, and restores instance-wide. Reviewed 2026-12-31. If no data.archive provision is procured by then, audit-core reopens placement under the \u00a74.5 retention trigger, with P2 as the fallback \u2014 a worse answer than archive, named now so it is not improvised later.", + "recommended_action": "Review the declared retention_placement-axis gap and retain, schedule, or resolve it explicitly.", + "service": "audit-core", + "severity": "low", + "source": "audit-core/tenancy.yaml" + }, + { + "class": "evidence-freshness-unknown", + "control": "E2", + "evidence_state": "unknown", + "id": "NKFB-c08b78e82248bf27", + "owner": "unknown", + "reason": "Current adversarial claim E2 has no authoritative evidence_freshness entry.", + "recommended_action": "Declare the E2 observation, expiry, bounded scope, responsible repository, and replacement action; do not infer freshness from prose.", + "service": "audit-core", + "severity": "high", + "source": "audit-core/tenancy.yaml" + }, + { + "class": "posture-review-overdue", + "control": "tenancy-posture", + "due": "2026-08-23", + "evidence_state": "overdue", + "id": "NKFB-cba6591a27598aad", + "owner": "unknown", + "reason": "tenancy-posture review was due on 2026-08-23 and is overdue at 2026-10-15T17:27:15Z.", + "recommended_action": "Review tenancy-posture, update its declaration and evidence, and retain the review record.", + "service": "audit-core", + "severity": "high", + "source": "audit-core/tenancy.yaml" + } + ], + "horizon_days": 14, + "kind": "PostureFeedbackReport", + "ok": true, + "report_digest": "sha256:80af5b6293f683a48f4555670c0403ec838e259965738e28298f7d75ba390986", + "summary": { + "high": 2, + "low": 8, + "medium": 0, + "total": 10, + "unknown_owner": 10 + }, + "validation_errors": [] +} diff --git a/docs/evidence/2026-10-15-posture-feedback-adoption/fail-on-high.json b/docs/evidence/2026-10-15-posture-feedback-adoption/fail-on-high.json new file mode 100644 index 0000000..10efe74 --- /dev/null +++ b/docs/evidence/2026-10-15-posture-feedback-adoption/fail-on-high.json @@ -0,0 +1,147 @@ +{ + "apiVersion": "netkingdom.io/posture-feedback/v0.1", + "as_of": "2026-10-15T17:27:15Z", + "automation": { + "declaration_mutation_permitted": false, + "external_write_permitted": false, + "mode": "proposal-only", + "policy_mutation_permitted": false + }, + "fail_on": "high", + "findings": [ + { + "class": "declared-gap", + "control": "A", + "evidence_state": "gap", + "id": "NKFB-f99aef50e23cb685", + "owner": "audit-core", + "reason": "A2 is accurate. Authorization is a single local boundary \u2014 permitted sources, permitted tenants, may_write, may_read \u2014 bound once and centrally. No flex-auth delegation. A3 is not a near-term target: flex-auth is itself at A0 on its own self-report (/v1/check authenticates no caller), so delegating to it today would lower this service's assurance, not raise it.", + "recommended_action": "Review the declared A-axis gap and retain, schedule, or resolve it explicitly.", + "service": "audit-core", + "severity": "low", + "source": "audit-core/tenancy.yaml" + }, + { + "class": "declared-gap", + "control": "E", + "evidence_state": "gap", + "id": "NKFB-799293aa994f85a0", + "owner": "audit-core", + "reason": "E2 is implemented on both paths by AUDIT-WP-0008-T04 and evidenced by the bounded whitehat-security target run WH-ENG-20260822-AUDIT-E2-03. An ordinary tenant-A identity could not fetch tenant B's event by id, observe tenant B's correlation fixture, or append as tenant B across ten attempted operations. The run ended 2026-08-22T22:10:25Z with no limitations; receipt-bound cleanup removed both temporary identities, both exact KV paths, all projection resources and the runner. This says only that the attempted attacks did not work, not that the boundary always holds. The 24-hour facility baseline makes review or replacement due at 2026-08-23T22:10:25Z, and relevant boundary changes require a pre-promotion run.", + "recommended_action": "Review the declared E-axis gap and retain, schedule, or resolve it explicitly.", + "service": "audit-core", + "severity": "low", + "source": "audit-core/tenancy.yaml" + }, + { + "class": "declared-gap", + "control": "E_target", + "evidence_state": "gap", + "id": "NKFB-383ced837546ffb2", + "owner": "audit-core", + "reason": "E3 (row-level security per rapp-postgres ADR-0003) targeted 2027-03-31. Blocked behind the E2 artifact \u2014 \u00a74.3 requires E2 evidence alongside any E3 claim \u2014 and needs the EXPLAIN comparison first, since RLS disables functional indexes built on non-leakproof functions. E4 is unreachable at P1 by the \u00a73.2 coupling and is not a target.", + "recommended_action": "Review the declared E_target-axis gap and retain, schedule, or resolve it explicitly.", + "service": "audit-core", + "severity": "low", + "source": "audit-core/tenancy.yaml" + }, + { + "class": "declared-gap", + "control": "I", + "evidence_state": "gap", + "id": "NKFB-9fbe41e33385dd8d", + "owner": "audit-core", + "reason": "I1 is accurate and is not currently a target. Senders authenticate with bearer tokens and the tenant arrives in the request body, checked against an allowlist bound to the credential (\u00a74.1 places request-supplied tenant identifiers at I1 however canonical the string). The allowlist is a real control, but it is an A-axis control; it does not make the identity verified. Moving to I2 means senders carrying a verified token with a tenant claim, which is a change to every sender and not audit-core's to make alone. Recorded as accurate, not as ambition.", + "recommended_action": "Review the declared I-axis gap and retain, schedule, or resolve it explicitly.", + "service": "audit-core", + "severity": "low", + "source": "audit-core/tenancy.yaml" + }, + { + "class": "declared-gap", + "control": "R_ceiling", + "evidence_state": "gap", + "id": "NKFB-a0f2e3e263ccc141", + "owner": "audit-core", + "reason": "R4 is unreachable under the current design and is not a target. Per Decision 4.5.3 \u2014 which this repo found \u2014 the hash chain commits to a SHA-256 of the cleartext record, which survives key destruction as a confirmation oracle over low-entropy fields. A fleet R4 target must exempt this service explicitly. See docs/erasure-and-audit.md (AUDIT-WP-0008-T03).", + "recommended_action": "Review the declared R_ceiling-axis gap and retain, schedule, or resolve it explicitly.", + "service": "audit-core", + "severity": "low", + "source": "audit-core/tenancy.yaml" + }, + { + "class": "declared-gap", + "control": "V", + "evidence_state": "gap", + "id": "NKFB-ea951e92dcbbe455", + "owner": "audit-core", + "reason": "V1 evidenced 2026-09-24 (AUDIT-WP-0008-T07). Receiver recreate recovered in about 7 seconds. Recreating the single platform-pg primary recovered the accept path 22 seconds after the pod terminated. The chain stayed intact. Lease revocation and node reboot were not part of the exercise. V2 is not reachable at P1 as built: platform-pg runs instances 1, and Decision 4.6.1 makes V the minimum across synchronous providers, so V1 is the ceiling. Review 2026-12-31.", + "recommended_action": "Review the declared V-axis gap and retain, schedule, or resolve it explicitly.", + "service": "audit-core", + "severity": "low", + "source": "audit-core/tenancy.yaml" + }, + { + "class": "declared-gap", + "control": "credentials", + "evidence_state": "gap", + "id": "NKFB-405c5a50c97cf3ce", + "owner": "audit-core", + "reason": "Stated gap against Decision 9.2 rather than a silent exclusion. Database credentials comply with 9.1: dynamic leases re-read from a mounted Secret at connection time, no restart on rotation. Ingest credentials do not: they are static long-lived bearer tokens, rotated overlap-first by publishing a replacement alongside the incumbent and then dropping the predecessor. audit-core raised this omission during review and is not exempting itself from the rule it asked for. No dated remedy yet; leasing consumer-facing credentials needs a broker path that does not exist.", + "recommended_action": "Review the declared credentials-axis gap and retain, schedule, or resolve it explicitly.", + "service": "audit-core", + "severity": "low", + "source": "audit-core/tenancy.yaml" + }, + { + "class": "declared-gap", + "control": "retention_placement", + "evidence_state": "gap", + "id": "NKFB-fa7016392a1b7029", + "owner": "audit-core", + "reason": "audit-core's INTENT wants unbounded WORM archive. That is data.archive in ITC-CAP terms, recorded as an unmet requirement in data/capability/audit-core-operational.json, and it is deliberately not a backup-window question: a 30-day WAL window is not an archive, is not searchable, and restores instance-wide. Reviewed 2026-12-31. If no data.archive provision is procured by then, audit-core reopens placement under the \u00a74.5 retention trigger, with P2 as the fallback \u2014 a worse answer than archive, named now so it is not improvised later.", + "recommended_action": "Review the declared retention_placement-axis gap and retain, schedule, or resolve it explicitly.", + "service": "audit-core", + "severity": "low", + "source": "audit-core/tenancy.yaml" + }, + { + "class": "evidence-expired", + "control": "E2", + "due": "2026-08-23T22:10:25Z", + "evidence_state": "expired", + "id": "NKFB-ab9248a8ad4d414a", + "owner": "audit-core", + "reason": "Evidence for E2 expired before 2026-10-15T17:27:15Z.", + "recommended_action": "Under AUDIT-WP-0015-T02, obtain the owner-confirmed bounded identities and a new Whitehat engagement with fresh plane admission and exact rules-of-engagement approval; run the cross-tenant E2 probes, complete receipt-bound cleanup, and publish the replacement report and freshness metadata. Prior -01/-02/-03 engagements are terminal and cannot be reused. Re-evaluate after relevant boundary changes before promotion. A later recovery exercise does not renew E2, and this declaration authorizes no live run.", + "service": "audit-core", + "severity": "high", + "source": "audit-core/tenancy.yaml" + }, + { + "class": "posture-review-overdue", + "control": "tenancy-posture", + "due": "2026-08-23", + "evidence_state": "overdue", + "id": "NKFB-cba6591a27598aad", + "owner": "audit-core", + "reason": "tenancy-posture review was due on 2026-08-23 and is overdue at 2026-10-15T17:27:15Z.", + "recommended_action": "Review tenancy-posture, update its declaration and evidence, and retain the review record.", + "service": "audit-core", + "severity": "high", + "source": "audit-core/tenancy.yaml" + } + ], + "horizon_days": 14, + "kind": "PostureFeedbackReport", + "ok": false, + "report_digest": "sha256:908349995c0b9254902703105f3f84609f1bea6c93e4be07c3ef9e82a5042898", + "summary": { + "high": 2, + "low": 8, + "medium": 0, + "total": 10, + "unknown_owner": 0 + }, + "validation_errors": [] +} diff --git a/workplans/NK-WP-0031-deterministic-posture-feedback.md b/workplans/NK-WP-0031-deterministic-posture-feedback.md index 22c1d51..4cda818 100644 --- a/workplans/NK-WP-0031-deterministic-posture-feedback.md +++ b/workplans/NK-WP-0031-deterministic-posture-feedback.md @@ -4,13 +4,13 @@ type: workplan title: "Implement deterministic posture and evidence feedback" domain: infotech repo: net-kingdom -status: active +status: finished flavor: residual owner: codex topic_slug: netkingdom planning_priority: P1 created: "2026-08-23" -updated: "2026-10-03" +updated: "2026-10-15" state_hub_workstream_id: "9d7b04f9-3803-5613-b7a5-8bd606c77f5a" --- @@ -75,9 +75,7 @@ portable source identity. ```task id: NK-WP-0031-T04 -status: wait -blocked_on: message-from:audit-core -blocking_reason: "audit-core tenancy.yaml must publish structured authoritative owner, observation/expiry and replacement-action metadata for WH-ENG-20260822-AUDIT-E2-03. Re-evaluate with explicit current as-of; later recovery prose does not renew E2." +status: done priority: high state_hub_task_id: "7d2029d2-db8d-526e-ab73-a0751becb193" ``` @@ -116,8 +114,8 @@ Verification on 2026-08-23: - the read-only seven-declaration baseline is recorded in `history/2026-08-23-posture-feedback-estate-baseline.md`. -Local implementation is complete. The workplan remains blocked only on T04's -externally owned audit-core declaration adoption. +Local implementation was complete on 2026-08-23. T04 adoption completed +2026-10-15; see the closure evidence below. ## Infrastructure review — 2026-09-28 @@ -140,3 +138,44 @@ Evidence and cross-plan priorities: [estate review](../history/2026-09-28-open-w > critical path (identity → authz → secrets → SecurityCase execution). Tasks are unchanged; > promote back when demand or risk appears. See the-custodian > `history/20261011-netkingdom-security-progress-assessment.md`. + + +## Adoption and closure — 2026-10-15 + +Founder resumed this workplan after the October 11 triage. All five tasks are +now done. Audit-core's authoritative `tenancy.yaml` publishes its responsible +repository plus `evidence_freshness.E2` with observation, original expiry, +bounded scope, target image digest and replacement action. Source adoption is +recorded in `audit-core/workplans/ADHOC-2026-10-15.md`. + +The observation and expiry come from the existing August 22 target receipt +and declaration: `2026-08-22T22:10:25Z` and `2026-08-23T22:10:25Z`. +No evidence was renewed from prose or September recovery exercises. The +posture levels, review dates and evidence references are unchanged. + +At explicit `--as-of 2026-10-15T17:27:15Z`, the evaluator changes E2 from +unknown freshness/owner to **expired**, owned by **audit-core**, with the +exact declared replacement action. The existing overdue posture review also +routes to audit-core. All ten findings now have an explicit owner; two high +findings and eight declared gaps remain visible. `--fail-on high` returns +1 as intended; proposal-only reporting does not mutate declarations or policy. + +Verification: **28 focused tests passed**, source schema/semantic validation +passed, repeated current-time reports were byte-identical, and source +comparison proves that only the new owner/freshness fields changed. Receipt +and report digests are recorded in the +[adoption evidence](../docs/evidence/2026-10-15-posture-feedback-adoption/adoption.json), +with [before](../docs/evidence/2026-10-15-posture-feedback-adoption/before.json) +and [after](../docs/evidence/2026-10-15-posture-feedback-adoption/after.json) reports. + +Fresh E2 production is not part of this completed adoption increment. The +existing live owner work record **AUDIT-WP-0015-T02** remains waiting for +identity/engagement prerequisites and a separately approved new run. It is +not closed or authorized by these metadata changes. No live packets, secret +access, runtime changes or posture-level changes occurred. + +Security orientation: Emergent Knowledge 0.2.6, package digest +`8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02`. +`start` and `evidence` were withheld/orientation-only because sources changed; +source cards, current repository instructions, security companion and original +owner evidence were reviewed directly. These receipts confer no live authority.