tenant-engine/docs/intakes/residuals.md

tenant-engine residual and finding intakes

Durable source records for actionable work that is not part of the workplan being closed. State Hub is the live routing index.

---

TEN-IN-0001 — Externalize tenant audit evidence to audit-core

id: TEN-IN-0001
kind: intake
title: "Externalize tenant-engine audit evidence to audit-core"
lane: yellow
status: open
priority: high
owner: tenant-engine
repo: tenant-engine
origin: residual
origin_ref: TEN-WP-0009
description: |
  TEN-WP-0009 made PostgreSQL the production authority but deliberately did
  not add a second cross-service write path. The local events table shares a
  database and runtime credential boundary with the facts it attests to, so a
  database-credential compromise could forge both the fact and its local
  evidence.

  Design and implement a governed tenant-engine to audit-core emission path:

  1. Agree the event envelope, sender registration and credential custody with
     audit-core without putting a secret in Git or a work record.
  2. Preserve mutation atomicity, idempotency and fail-closed behavior while
     defining retry, duplicate and audit-core-unavailable semantics.
  3. Prove the external copy cannot be rewritten through tenant-engine's
     runtime database credential.
  4. Decide explicitly whether the seven pre-cutover event classes require a
     bounded backfill, and record the decision.

  Promote this intake to a normal workplan before implementation because the
  delivery semantics and cross-service dependency require design and review.
state_hub_intake_id: "01a02176-8ca7-725d-b2c2-4353eb4fd3f5"

---

TEN-IN-0002 — Remove or authorize the unfiltered event-read interface

id: TEN-IN-0002
kind: intake
title: "Remove or authorize the tenant-engine unfiltered event-read interface"
lane: red
status: open
priority: high
owner: tenant-engine
repo: tenant-engine
origin: risk-finding
origin_ref: RISK-F-0004
description: |
  RISK-F-0004 correctly observes that TenantStore.events() returns every
  tenant's event and payload. The accessibility part of the initial finding is
  overstated: this is currently an in-process store interface used by tests,
  and tenant-engine exposes no HTTP event-read route.

  Make the boundary explicit by removing events() from the production protocol
  or replacing it with an authorized, deliberately scoped export/query
  interface. Add cross-tenant negative tests and give risk-nexus the final
  accessibility and payload reading.
state_hub_intake_id: "01a02176-c121-7952-8d52-2cbe282fd883"