tegwick
672cf4da6e
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 37s
Engine/PIP declaration is now checkable (layer.yaml plus a Tooling-client scan). Writes persist a decision record or the published fail-closed stance, live-lookup freshness is published, events_for is tenant-scoped, and mutation evidence drains to audit-core from a local outbox without blocking the mutation. Sender registration is requested as AUDIT-IN-0002. Boundary-contract amendment is requested as NET-IN-0002. Assistant: grok Assistant-Session: 01a04cea-e5e8-7081-a0fc-808ebbc35fa9
84 lines
3.1 KiB
Markdown
84 lines
3.1 KiB
Markdown
# tenant-engine residual and finding intakes
|
|
|
|
Durable source records for actionable work that is not part of the workplan
|
|
being closed. State Hub is the live routing index.
|
|
|
|
---
|
|
|
|
## TEN-IN-0001 — Externalize tenant audit evidence to audit-core
|
|
|
|
```yaml
|
|
id: TEN-IN-0001
|
|
kind: intake
|
|
title: "Externalize tenant-engine audit evidence to audit-core"
|
|
lane: yellow
|
|
status: closed
|
|
outcome: completed
|
|
promoted_to: TEN-WP-0011-T04
|
|
priority: high
|
|
owner: tenant-engine
|
|
repo: tenant-engine
|
|
origin: residual
|
|
origin_ref: TEN-WP-0009
|
|
description: |
|
|
TEN-WP-0009 made PostgreSQL the production authority but deliberately did
|
|
not add a second cross-service write path. The local events table shares a
|
|
database and runtime credential boundary with the facts it attests to, so a
|
|
database-credential compromise could forge both the fact and its local
|
|
evidence.
|
|
|
|
Design and implement a governed tenant-engine to audit-core emission path:
|
|
|
|
1. Agree the event envelope, sender registration and credential custody with
|
|
audit-core without putting a secret in Git or a work record.
|
|
2. Preserve mutation atomicity, idempotency and fail-closed behavior while
|
|
defining retry, duplicate and audit-core-unavailable semantics.
|
|
3. Prove the external copy cannot be rewritten through tenant-engine's
|
|
runtime database credential.
|
|
4. Decide explicitly whether the seven pre-cutover event classes require a
|
|
bounded backfill, and record the decision.
|
|
|
|
Promote this intake to a normal workplan before implementation because the
|
|
delivery semantics and cross-service dependency require design and review.
|
|
state_hub_intake_id: "01a02176-8ca7-725d-b2c2-4353eb4fd3f5"
|
|
promoted_at: "2026-08-29"
|
|
notes:
|
|
- content: Promoted into TEN-WP-0011-T04 after security-layer-model v0.7 made the evidence bound (statute §9.6) explicit for this PIP.
|
|
author: tenant-engine
|
|
created: "2026-08-29"
|
|
```
|
|
|
|
---
|
|
|
|
## TEN-IN-0002 — Remove or authorize the unfiltered event-read interface
|
|
|
|
```yaml
|
|
id: TEN-IN-0002
|
|
kind: intake
|
|
title: "Remove or authorize the tenant-engine unfiltered event-read interface"
|
|
lane: red
|
|
status: closed
|
|
outcome: completed
|
|
promoted_to: TEN-WP-0011-T05
|
|
priority: high
|
|
owner: tenant-engine
|
|
repo: tenant-engine
|
|
origin: risk-finding
|
|
origin_ref: RISK-F-0004
|
|
description: |
|
|
RISK-F-0004 correctly observes that TenantStore.events() returns every
|
|
tenant's event and payload. The accessibility part of the initial finding is
|
|
overstated: this is currently an in-process store interface used by tests,
|
|
and tenant-engine exposes no HTTP event-read route.
|
|
|
|
Make the boundary explicit by removing events() from the production protocol
|
|
or replacing it with an authorized, deliberately scoped export/query
|
|
interface. Add cross-tenant negative tests and give risk-nexus the final
|
|
accessibility and payload reading.
|
|
state_hub_intake_id: "01a02176-c121-7952-8d52-2cbe282fd883"
|
|
promoted_at: "2026-08-29"
|
|
notes:
|
|
- content: Promoted into TEN-WP-0011-T05. Unfiltered production-protocol event reads remain a reconstructability defect under statute §9.6 even without an HTTP route.
|
|
author: tenant-engine
|
|
created: "2026-08-29"
|
|
```
|