tegwick
672cf4da6e
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 37s
Engine/PIP declaration is now checkable (layer.yaml plus a Tooling-client scan). Writes persist a decision record or the published fail-closed stance, live-lookup freshness is published, events_for is tenant-scoped, and mutation evidence drains to audit-core from a local outbox without blocking the mutation. Sender registration is requested as AUDIT-IN-0002. Boundary-contract amendment is requested as NET-IN-0002. Assistant: grok Assistant-Session: 01a04cea-e5e8-7081-a0fc-808ebbc35fa9
84 lines
2.7 KiB
YAML
84 lines
2.7 KiB
YAML
# tenant-engine — NetKingdom security layer declaration
|
|
#
|
|
# Framework: net-kingdom/canon/standards/security-layer-model_v0.7.md
|
|
# Companion: net-kingdom/SECURITY-COMPANION.md v0.2
|
|
# Assent: decisions/decisions.md TEN-DEC-2026-001
|
|
# Validate: python3 scripts/check_layer_conformance.py
|
|
#
|
|
# Engine / PIP. Same authoritative tenant state yields the same result. We
|
|
# supply tenant-as-an-entity facts as claims; we do not render a decision.
|
|
# Writes are PEP-shaped (pep-stance.yaml). Catalogued Tooling (§4) is
|
|
# key-cape and OpenBao — we hold no client for either.
|
|
|
|
schema_version: "0.1"
|
|
framework: netkingdom-security-layer-model
|
|
standard_version: "0.7"
|
|
repository: tenant-engine
|
|
layer: engine
|
|
role: pip
|
|
declared_by: decisions/decisions.md#TEN-DEC-2026-001
|
|
declared_at: "2026-08-29"
|
|
|
|
pep_stance: pep-stance.yaml
|
|
pip_claims: pip-claims.yaml
|
|
|
|
catalog_entry:
|
|
owns:
|
|
- tenant-as-an-entity facts
|
|
|
|
# Empty is a claim. scripts/check_layer_conformance.py fails a new OpenBao
|
|
# or key-cape client that is not listed here.
|
|
tooling_contacts: []
|
|
|
|
declared_shapes:
|
|
"5.1": []
|
|
"5.2": []
|
|
"5.3": []
|
|
|
|
non_tooling_clients:
|
|
- id: postgres-own-store
|
|
module: src/tenant_engine/postgres_store.py
|
|
target: PostgreSQL
|
|
layer: not-catalogued
|
|
operation: "psycopg pool against TENANT_ENGINE_DATABASE_URL_FILE"
|
|
write: true
|
|
note: >-
|
|
Persistence this engine owns for its own facts. Companion §4: list
|
|
uncatalogued infrastructure so the check is total. Not a Tooling
|
|
contact — OpenBao and key-cape are the §4 Tooling rows.
|
|
|
|
- id: sqlite-dev-store
|
|
module: src/tenant_engine/sqlite_store.py
|
|
target: SQLite
|
|
layer: not-catalogued
|
|
operation: "sqlite3 file used for development and test"
|
|
write: true
|
|
note: "Dev/test backend. Production is PostgreSQL (TEN-WP-0009)."
|
|
|
|
- id: access-engine-check
|
|
module: src/tenant_engine/flex_auth.py
|
|
target: access-engine (flex-auth)
|
|
layer: engine
|
|
operation: "HTTP POST /v1/check"
|
|
write: false
|
|
note: "Engine API. §5 permits it; this is the shape §5 prescribes."
|
|
|
|
- id: audit-core-emission
|
|
module: src/tenant_engine/audit_core.py
|
|
target: audit-core
|
|
layer: engine
|
|
operation: "HTTP POST /v1/events from the local outbox"
|
|
write: true
|
|
note: >-
|
|
Evidence engine. Emission is attributive and non-blocking
|
|
(docs/evidence-emission.md). Sender registration on audit-core is
|
|
requested separately.
|
|
|
|
- id: state-hub-work-records
|
|
target: state-hub
|
|
layer: not-catalogued
|
|
operation: "HTTP to the Custodian State Hub for work records"
|
|
write: true
|
|
note: >-
|
|
Outside §5 by the v0.7 scope rule. Recorded, not policed. Carries no
|
|
tenant-fact authority and no secret payload.
|