coulomb/tenant-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement TEN-WP-0011 security layer conformance
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 37s
Details

Browse source 
Engine/PIP declaration is now checkable (layer.yaml plus a Tooling-client
scan). Writes persist a decision record or the published fail-closed
stance, live-lookup freshness is published, events_for is tenant-scoped,
and mutation evidence drains to audit-core from a local outbox without
blocking the mutation.

Sender registration is requested as AUDIT-IN-0002. Boundary-contract
amendment is requested as NET-IN-0002.

Assistant: grok
Assistant-Session: 01a04cea-e5e8-7081-a0fc-808ebbc35fa9
This commit is contained in:
tegwick 2026-08-29 13:02:51 +02:00
parent 80961af91e
commit 672cf4da6e
40 changed files with 2285 additions and 361 deletions
Download patch file Download diff file Expand all files Collapse all files

4
tests/test_lifecycle_store_conformance.py
View file

@ -212,13 +212,13 @@ def test_retirement_preserves_existing_grant_and_plan_history(store, tenant) ->
# Retirement is not a revocation: history stays queryable for audit and
# so reactivation does not have to reconstruct anything.
assert store.active_roles("t-1") == frozenset({CapabilityRole.CUS})
assert any(event.event_type == "plan_assigned" for event in store.events())
assert any(event.event_type == "plan_assigned" for event in store.events_for(tenant.tenant_id))
def test_mutation_emits_a_correlated_audit_event(store, tenant) -> None:
_rename(store, key="k1", version=1)
event = [e for e in store.events() if e.event_type == "tenant_updated"][-1]
event = [e for e in store.events_for(tenant.tenant_id) if e.event_type == "tenant_updated"][-1]
assert event.payload["actor"] == "ops"
assert event.payload["reason"] == "rename"
assert event.payload["correlation_id"] == "corr-1"