tegwick
311620bbdb
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
147 lines
9 KiB
JSON
147 lines
9 KiB
JSON
{
|
|
"apiVersion": "netkingdom.io/posture-feedback/v0.1",
|
|
"as_of": "2026-10-15T17:27:15Z",
|
|
"automation": {
|
|
"declaration_mutation_permitted": false,
|
|
"external_write_permitted": false,
|
|
"mode": "proposal-only",
|
|
"policy_mutation_permitted": false
|
|
},
|
|
"fail_on": "none",
|
|
"findings": [
|
|
{
|
|
"class": "declared-gap",
|
|
"control": "A",
|
|
"evidence_state": "gap",
|
|
"id": "NKFB-f99aef50e23cb685",
|
|
"owner": "audit-core",
|
|
"reason": "A2 is accurate. Authorization is a single local boundary \u2014 permitted sources, permitted tenants, may_write, may_read \u2014 bound once and centrally. No flex-auth delegation. A3 is not a near-term target: flex-auth is itself at A0 on its own self-report (/v1/check authenticates no caller), so delegating to it today would lower this service's assurance, not raise it.",
|
|
"recommended_action": "Review the declared A-axis gap and retain, schedule, or resolve it explicitly.",
|
|
"service": "audit-core",
|
|
"severity": "low",
|
|
"source": "audit-core/tenancy.yaml"
|
|
},
|
|
{
|
|
"class": "declared-gap",
|
|
"control": "E",
|
|
"evidence_state": "gap",
|
|
"id": "NKFB-799293aa994f85a0",
|
|
"owner": "audit-core",
|
|
"reason": "E2 is implemented on both paths by AUDIT-WP-0008-T04 and evidenced by the bounded whitehat-security target run WH-ENG-20260822-AUDIT-E2-03. An ordinary tenant-A identity could not fetch tenant B's event by id, observe tenant B's correlation fixture, or append as tenant B across ten attempted operations. The run ended 2026-08-22T22:10:25Z with no limitations; receipt-bound cleanup removed both temporary identities, both exact KV paths, all projection resources and the runner. This says only that the attempted attacks did not work, not that the boundary always holds. The 24-hour facility baseline makes review or replacement due at 2026-08-23T22:10:25Z, and relevant boundary changes require a pre-promotion run.",
|
|
"recommended_action": "Review the declared E-axis gap and retain, schedule, or resolve it explicitly.",
|
|
"service": "audit-core",
|
|
"severity": "low",
|
|
"source": "audit-core/tenancy.yaml"
|
|
},
|
|
{
|
|
"class": "declared-gap",
|
|
"control": "E_target",
|
|
"evidence_state": "gap",
|
|
"id": "NKFB-383ced837546ffb2",
|
|
"owner": "audit-core",
|
|
"reason": "E3 (row-level security per rapp-postgres ADR-0003) targeted 2027-03-31. Blocked behind the E2 artifact \u2014 \u00a74.3 requires E2 evidence alongside any E3 claim \u2014 and needs the EXPLAIN comparison first, since RLS disables functional indexes built on non-leakproof functions. E4 is unreachable at P1 by the \u00a73.2 coupling and is not a target.",
|
|
"recommended_action": "Review the declared E_target-axis gap and retain, schedule, or resolve it explicitly.",
|
|
"service": "audit-core",
|
|
"severity": "low",
|
|
"source": "audit-core/tenancy.yaml"
|
|
},
|
|
{
|
|
"class": "declared-gap",
|
|
"control": "I",
|
|
"evidence_state": "gap",
|
|
"id": "NKFB-9fbe41e33385dd8d",
|
|
"owner": "audit-core",
|
|
"reason": "I1 is accurate and is not currently a target. Senders authenticate with bearer tokens and the tenant arrives in the request body, checked against an allowlist bound to the credential (\u00a74.1 places request-supplied tenant identifiers at I1 however canonical the string). The allowlist is a real control, but it is an A-axis control; it does not make the identity verified. Moving to I2 means senders carrying a verified token with a tenant claim, which is a change to every sender and not audit-core's to make alone. Recorded as accurate, not as ambition.",
|
|
"recommended_action": "Review the declared I-axis gap and retain, schedule, or resolve it explicitly.",
|
|
"service": "audit-core",
|
|
"severity": "low",
|
|
"source": "audit-core/tenancy.yaml"
|
|
},
|
|
{
|
|
"class": "declared-gap",
|
|
"control": "R_ceiling",
|
|
"evidence_state": "gap",
|
|
"id": "NKFB-a0f2e3e263ccc141",
|
|
"owner": "audit-core",
|
|
"reason": "R4 is unreachable under the current design and is not a target. Per Decision 4.5.3 \u2014 which this repo found \u2014 the hash chain commits to a SHA-256 of the cleartext record, which survives key destruction as a confirmation oracle over low-entropy fields. A fleet R4 target must exempt this service explicitly. See docs/erasure-and-audit.md (AUDIT-WP-0008-T03).",
|
|
"recommended_action": "Review the declared R_ceiling-axis gap and retain, schedule, or resolve it explicitly.",
|
|
"service": "audit-core",
|
|
"severity": "low",
|
|
"source": "audit-core/tenancy.yaml"
|
|
},
|
|
{
|
|
"class": "declared-gap",
|
|
"control": "V",
|
|
"evidence_state": "gap",
|
|
"id": "NKFB-ea951e92dcbbe455",
|
|
"owner": "audit-core",
|
|
"reason": "V1 evidenced 2026-09-24 (AUDIT-WP-0008-T07). Receiver recreate recovered in about 7 seconds. Recreating the single platform-pg primary recovered the accept path 22 seconds after the pod terminated. The chain stayed intact. Lease revocation and node reboot were not part of the exercise. V2 is not reachable at P1 as built: platform-pg runs instances 1, and Decision 4.6.1 makes V the minimum across synchronous providers, so V1 is the ceiling. Review 2026-12-31.",
|
|
"recommended_action": "Review the declared V-axis gap and retain, schedule, or resolve it explicitly.",
|
|
"service": "audit-core",
|
|
"severity": "low",
|
|
"source": "audit-core/tenancy.yaml"
|
|
},
|
|
{
|
|
"class": "declared-gap",
|
|
"control": "credentials",
|
|
"evidence_state": "gap",
|
|
"id": "NKFB-405c5a50c97cf3ce",
|
|
"owner": "audit-core",
|
|
"reason": "Stated gap against Decision 9.2 rather than a silent exclusion. Database credentials comply with 9.1: dynamic leases re-read from a mounted Secret at connection time, no restart on rotation. Ingest credentials do not: they are static long-lived bearer tokens, rotated overlap-first by publishing a replacement alongside the incumbent and then dropping the predecessor. audit-core raised this omission during review and is not exempting itself from the rule it asked for. No dated remedy yet; leasing consumer-facing credentials needs a broker path that does not exist.",
|
|
"recommended_action": "Review the declared credentials-axis gap and retain, schedule, or resolve it explicitly.",
|
|
"service": "audit-core",
|
|
"severity": "low",
|
|
"source": "audit-core/tenancy.yaml"
|
|
},
|
|
{
|
|
"class": "declared-gap",
|
|
"control": "retention_placement",
|
|
"evidence_state": "gap",
|
|
"id": "NKFB-fa7016392a1b7029",
|
|
"owner": "audit-core",
|
|
"reason": "audit-core's INTENT wants unbounded WORM archive. That is data.archive in ITC-CAP terms, recorded as an unmet requirement in data/capability/audit-core-operational.json, and it is deliberately not a backup-window question: a 30-day WAL window is not an archive, is not searchable, and restores instance-wide. Reviewed 2026-12-31. If no data.archive provision is procured by then, audit-core reopens placement under the \u00a74.5 retention trigger, with P2 as the fallback \u2014 a worse answer than archive, named now so it is not improvised later.",
|
|
"recommended_action": "Review the declared retention_placement-axis gap and retain, schedule, or resolve it explicitly.",
|
|
"service": "audit-core",
|
|
"severity": "low",
|
|
"source": "audit-core/tenancy.yaml"
|
|
},
|
|
{
|
|
"class": "evidence-expired",
|
|
"control": "E2",
|
|
"due": "2026-08-23T22:10:25Z",
|
|
"evidence_state": "expired",
|
|
"id": "NKFB-ab9248a8ad4d414a",
|
|
"owner": "audit-core",
|
|
"reason": "Evidence for E2 expired before 2026-10-15T17:27:15Z.",
|
|
"recommended_action": "Under AUDIT-WP-0015-T02, obtain the owner-confirmed bounded identities and a new Whitehat engagement with fresh plane admission and exact rules-of-engagement approval; run the cross-tenant E2 probes, complete receipt-bound cleanup, and publish the replacement report and freshness metadata. Prior -01/-02/-03 engagements are terminal and cannot be reused. Re-evaluate after relevant boundary changes before promotion. A later recovery exercise does not renew E2, and this declaration authorizes no live run.",
|
|
"service": "audit-core",
|
|
"severity": "high",
|
|
"source": "audit-core/tenancy.yaml"
|
|
},
|
|
{
|
|
"class": "posture-review-overdue",
|
|
"control": "tenancy-posture",
|
|
"due": "2026-08-23",
|
|
"evidence_state": "overdue",
|
|
"id": "NKFB-cba6591a27598aad",
|
|
"owner": "audit-core",
|
|
"reason": "tenancy-posture review was due on 2026-08-23 and is overdue at 2026-10-15T17:27:15Z.",
|
|
"recommended_action": "Review tenancy-posture, update its declaration and evidence, and retain the review record.",
|
|
"service": "audit-core",
|
|
"severity": "high",
|
|
"source": "audit-core/tenancy.yaml"
|
|
}
|
|
],
|
|
"horizon_days": 14,
|
|
"kind": "PostureFeedbackReport",
|
|
"ok": true,
|
|
"report_digest": "sha256:64a9c9e86a93e989646f4c614f05d27d8e75cc78f88b80e18aeef0493b91db0a",
|
|
"summary": {
|
|
"high": 2,
|
|
"low": 8,
|
|
"medium": 0,
|
|
"total": 10,
|
|
"unknown_owner": 0
|
|
},
|
|
"validation_errors": []
|
|
}
|