Implement TEN-WP-0011 security layer conformance
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 37s

Engine/PIP declaration is now checkable (layer.yaml plus a Tooling-client
scan). Writes persist a decision record or the published fail-closed
stance, live-lookup freshness is published, events_for is tenant-scoped,
and mutation evidence drains to audit-core from a local outbox without
blocking the mutation.

Sender registration is requested as AUDIT-IN-0002. Boundary-contract
amendment is requested as NET-IN-0002.

Assistant: grok
Assistant-Session: 01a04cea-e5e8-7081-a0fc-808ebbc35fa9
This commit is contained in:
tegwick 2026-08-29 13:02:51 +02:00
parent 80961af91e
commit 672cf4da6e
40 changed files with 2285 additions and 361 deletions

2
uv.lock generated
View file

@ -482,6 +482,7 @@ dependencies = [
[package.optional-dependencies]
dev = [
{ name = "pytest" },
{ name = "pyyaml" },
{ name = "ruff" },
]
postgres = [
@ -496,6 +497,7 @@ requires-dist = [
{ name = "psycopg", extras = ["binary"], marker = "extra == 'postgres'", specifier = ">=3.2,<4.0" },
{ name = "psycopg-pool", marker = "extra == 'postgres'", specifier = ">=3.2,<4.0" },
{ name = "pytest", marker = "extra == 'dev'", specifier = ">=8.2,<9.0" },
{ name = "pyyaml", marker = "extra == 'dev'", specifier = ">=6.0,<7.0" },
{ name = "ruff", marker = "extra == 'dev'", specifier = ">=0.6,<1.0" },
{ name = "uvicorn", extras = ["standard"], specifier = ">=0.30,<1.0" },
]