tegwick
672cf4da6e
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 37s
Engine/PIP declaration is now checkable (layer.yaml plus a Tooling-client scan). Writes persist a decision record or the published fail-closed stance, live-lookup freshness is published, events_for is tenant-scoped, and mutation evidence drains to audit-core from a local outbox without blocking the mutation. Sender registration is requested as AUDIT-IN-0002. Boundary-contract amendment is requested as NET-IN-0002. Assistant: grok Assistant-Session: 01a04cea-e5e8-7081-a0fc-808ebbc35fa9
3.1 KiB
3.1 KiB
tenant-engine residual and finding intakes
Durable source records for actionable work that is not part of the workplan being closed. State Hub is the live routing index.
TEN-IN-0001 — Externalize tenant audit evidence to audit-core
id: TEN-IN-0001
kind: intake
title: "Externalize tenant-engine audit evidence to audit-core"
lane: yellow
status: closed
outcome: completed
promoted_to: TEN-WP-0011-T04
priority: high
owner: tenant-engine
repo: tenant-engine
origin: residual
origin_ref: TEN-WP-0009
description: |
TEN-WP-0009 made PostgreSQL the production authority but deliberately did
not add a second cross-service write path. The local events table shares a
database and runtime credential boundary with the facts it attests to, so a
database-credential compromise could forge both the fact and its local
evidence.
Design and implement a governed tenant-engine to audit-core emission path:
1. Agree the event envelope, sender registration and credential custody with
audit-core without putting a secret in Git or a work record.
2. Preserve mutation atomicity, idempotency and fail-closed behavior while
defining retry, duplicate and audit-core-unavailable semantics.
3. Prove the external copy cannot be rewritten through tenant-engine's
runtime database credential.
4. Decide explicitly whether the seven pre-cutover event classes require a
bounded backfill, and record the decision.
Promote this intake to a normal workplan before implementation because the
delivery semantics and cross-service dependency require design and review.
state_hub_intake_id: "01a02176-8ca7-725d-b2c2-4353eb4fd3f5"
promoted_at: "2026-08-29"
notes:
- content: Promoted into TEN-WP-0011-T04 after security-layer-model v0.7 made the evidence bound (statute §9.6) explicit for this PIP.
author: tenant-engine
created: "2026-08-29"
TEN-IN-0002 — Remove or authorize the unfiltered event-read interface
id: TEN-IN-0002
kind: intake
title: "Remove or authorize the tenant-engine unfiltered event-read interface"
lane: red
status: closed
outcome: completed
promoted_to: TEN-WP-0011-T05
priority: high
owner: tenant-engine
repo: tenant-engine
origin: risk-finding
origin_ref: RISK-F-0004
description: |
RISK-F-0004 correctly observes that TenantStore.events() returns every
tenant's event and payload. The accessibility part of the initial finding is
overstated: this is currently an in-process store interface used by tests,
and tenant-engine exposes no HTTP event-read route.
Make the boundary explicit by removing events() from the production protocol
or replacing it with an authorized, deliberately scoped export/query
interface. Add cross-tenant negative tests and give risk-nexus the final
accessibility and payload reading.
state_hub_intake_id: "01a02176-c121-7952-8d52-2cbe282fd883"
promoted_at: "2026-08-29"
notes:
- content: Promoted into TEN-WP-0011-T05. Unfiltered production-protocol event reads remain a reconstructability defect under statute §9.6 even without an HTTP route.
author: tenant-engine
created: "2026-08-29"