coulomb/tenant-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement TEN-WP-0011 security layer conformance
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 37s
Details

Browse source 
Engine/PIP declaration is now checkable (layer.yaml plus a Tooling-client
scan). Writes persist a decision record or the published fail-closed
stance, live-lookup freshness is published, events_for is tenant-scoped,
and mutation evidence drains to audit-core from a local outbox without
blocking the mutation.

Sender registration is requested as AUDIT-IN-0002. Boundary-contract
amendment is requested as NET-IN-0002.

Assistant: grok
Assistant-Session: 01a04cea-e5e8-7081-a0fc-808ebbc35fa9
This commit is contained in:
tegwick 2026-08-29 13:02:51 +02:00
parent 80961af91e
commit 672cf4da6e
40 changed files with 2285 additions and 361 deletions
Download patch file Download diff file Expand all files Collapse all files

26
workplans/TEN-WP-0011-security-layer-conformance.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Align tenant-engine with the accepted security layer model"
domain: infotech
repo: tenant-engine
status: ready
status: finished
owner: grok
topic_slug: netkingdom
created: "2026-08-29"
@ -58,7 +58,7 @@ code.
```task
id: TEN-WP-0011-T01
status: todo
status: done
priority: high
state_hub_task_id: "f46944d8-e638-5f64-a4ad-a713102dfa72"
```
@ -81,7 +81,7 @@ in `src/`.
```task
id: TEN-WP-0011-T02
status: todo
status: done
priority: high
state_hub_task_id: "62659305-8283-594e-8670-f9335f5c74a0"
```
@ -114,7 +114,7 @@ file == code; no write path can succeed without one of those two records.
```task
id: TEN-WP-0011-T03
status: todo
status: done
priority: high
state_hub_task_id: "7815548c-36aa-518c-812e-8562be3a5111"
```
@ -145,7 +145,7 @@ evidence, not a comment.
```task
id: TEN-WP-0011-T04
status: todo
status: done
priority: high
state_hub_task_id: "cfab6837-5f62-5beb-b99f-943d39b5b94d"
```
@ -178,11 +178,16 @@ Done when: production mutations emit to `audit-core` under the bound above;
the trade (atomic vs non-blocking) is declared; `TEN-IN-0001` can close as
promoted and completed.
**Done 2026-08-29:** local outbox is in the mutation transaction; drain
POSTs `/v1/events` and never fails the mutation; trade declared in
`docs/evidence-emission.md`; no pre-cutover backfill. Production landing
waits on sender registration, requested as `AUDIT-IN-0002`.
## T05 — Remove or authorize the unfiltered event-read interface
```task
id: TEN-WP-0011-T05
status: todo
status: done
priority: high
state_hub_task_id: "7540049b-9b76-5d16-9ce4-57395a53ecbc"
```
@ -202,11 +207,15 @@ the dump.
Done when: a production caller cannot list another tenant's events through
this repo's store protocol; tests say so; `TEN-IN-0002` can close.
**Done 2026-08-29:** `events()` removed from the production protocol;
`events_for(tenant_id)` is the only read. Cross-tenant negative test in
`tests/test_events_scoped.py`. Reading handed to risk-nexus.
## T06 — Request the boundary-contract amendment
```task
id: TEN-WP-0011-T06
status: todo
status: done
priority: medium
state_hub_task_id: "ffd2cc53-bde2-5e3c-a144-ab565bc12776"
```
@ -229,3 +238,6 @@ to:
Done when: the intake exists on the canon side with a named id, and this
task records it.
**Done 2026-08-29:** filed `NET-IN-0002` on `net-kingdom`
(`net-kingdom/intakes/intakes.md`).