docs: finish PostgreSQL production cutover

docs/intakes/residuals.md

@@ -0,0 +1,70 @@
+# tenant-engine residual and finding intakes
+
+Durable source records for actionable work that is not part of the workplan
+being closed. State Hub is the live routing index.
+
+---
+
+## TEN-IN-0001 — Externalize tenant audit evidence to audit-core
+
+```yaml
+id: TEN-IN-0001
+kind: intake
+title: "Externalize tenant-engine audit evidence to audit-core"
+lane: yellow
+status: open
+priority: high
+owner: tenant-engine
+repo: tenant-engine
+origin: residual
+origin_ref: TEN-WP-0009
+description: |
+  TEN-WP-0009 made PostgreSQL the production authority but deliberately did
+  not add a second cross-service write path. The local events table shares a
+  database and runtime credential boundary with the facts it attests to, so a
+  database-credential compromise could forge both the fact and its local
+  evidence.
+
+  Design and implement a governed tenant-engine to audit-core emission path:
+
+  1. Agree the event envelope, sender registration and credential custody with
+     audit-core without putting a secret in Git or a work record.
+  2. Preserve mutation atomicity, idempotency and fail-closed behavior while
+     defining retry, duplicate and audit-core-unavailable semantics.
+  3. Prove the external copy cannot be rewritten through tenant-engine's
+     runtime database credential.
+  4. Decide explicitly whether the seven pre-cutover event classes require a
+     bounded backfill, and record the decision.
+
+  Promote this intake to a normal workplan before implementation because the
+  delivery semantics and cross-service dependency require design and review.
+state_hub_intake_id: "01a02176-8ca7-725d-b2c2-4353eb4fd3f5"
+```
+
+---
+
+## TEN-IN-0002 — Remove or authorize the unfiltered event-read interface
+
+```yaml
+id: TEN-IN-0002
+kind: intake
+title: "Remove or authorize the tenant-engine unfiltered event-read interface"
+lane: red
+status: open
+priority: high
+owner: tenant-engine
+repo: tenant-engine
+origin: risk-finding
+origin_ref: RISK-F-0004
+description: |
+  RISK-F-0004 correctly observes that TenantStore.events() returns every
+  tenant's event and payload. The accessibility part of the initial finding is
+  overstated: this is currently an in-process store interface used by tests,
+  and tenant-engine exposes no HTTP event-read route.
+
+  Make the boundary explicit by removing events() from the production protocol
+  or replacing it with an authorized, deliberately scoped export/query
+  interface. Add cross-tenant negative tests and give risk-nexus the final
+  accessibility and payload reading.
+state_hub_intake_id: "01a02176-c121-7952-8d52-2cbe282fd883"
+```