From 6ca8fda2751dc26a9c1ad91f76ec830ec8e75c52 Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 24 Sep 2026 15:53:09 +0200 Subject: [PATCH] Record audit-core availability as V1 in the worked example. Assistant: grok Assistant-Session: 01a0d25d-d358-7e13-b84a-d007fbb7e34f --- canon/standards/tenancy-posture_v0.1.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/canon/standards/tenancy-posture_v0.1.md b/canon/standards/tenancy-posture_v0.1.md index c217e21..88f1cfd 100644 --- a/canon/standards/tenancy-posture_v0.1.md +++ b/canon/standards/tenancy-posture_v0.1.md @@ -784,7 +784,7 @@ consistently: | Service | Current | Notes | |---|---|---| | `tenant-engine` | `I1 A0 E1 P n/a R0 V0` | Acting identity is caller-supplied; unauthorised read paths set the A minimum; E2-shaped child-table controls are not evidenced; SQLite is outside P; no erasure or availability evidence. This corrects draft-7, which quoted A2/E2 despite its own minimum/evidence rules. | -| `audit-core` | `I1 A2 E2 P1 R2 V0` | Bounded adversarial run `WH-ENG-20260822-AUDIT-E2-03` passed all three calibrated cross-tenant probes over ten operations, so E2 is evidenced as of 2026-08-22. This establishes only that the attempted attacks did not work. The 24-hour facility baseline requires review or replacement by `2026-08-23T22:10:25Z`. Its 30-day retention and erasure horizon remain declared and published. | +| `audit-core` | `I1 A2 E2 P1 R2 V1` | Bounded adversarial run `WH-ENG-20260822-AUDIT-E2-03` passed all three calibrated cross-tenant probes over ten operations, so E2 is evidenced as of 2026-08-22. This establishes only that the attempted attacks did not work. The 24-hour facility baseline requires review or replacement by `2026-08-23T22:10:25Z`. Its 30-day retention and erasure horizon remain declared and published. V1 is the 2026-09-24 restart exercise: receiver recreate about 7s, platform-pg primary recreate 22s from pod termination to the next accept, chain intact. Review 2026-12-31. | | `flex-auth` | `I1 A0 E1 P n/a R n/a V0` | Enables A3 for consumers. `/v1/check` authenticates no caller; E2 is implemented but not evidenced. | | `platform-pg` (provider) | `I0 A0 E0 P n/a R2 V1` | Provides P1; backup/restore and single-node recovery are evidenced. Provides no tenant boundary by itself. | | `apps-pg` (provider) | `I0 A0 E0 P n/a R0 V0` | Zeros are structural, except R0/V0 are live gaps: no backup and no recovery evidence. |