47 lines
1.9 KiB
Markdown
47 lines
1.9 KiB
Markdown
|
# Local evidence classification
|
||
|
|
|
||
|
|
Status: implemented
|
||
|
|
Updated: 2026-08-29
|
||
|
|
Standard: `net-kingdom/canon/standards/security-layer-model_v0.7.md` §9.6
|
||
|
|
Companion: `net-kingdom/SECURITY-COMPANION.md` §6
|
||
|
|
|
||
|
|
Local audit records and the durable outbox prove the records they hold
|
||
|
|
were **not altered or truncated after arrival**. They do not prove that
|
||
|
|
an event never sent did not happen.
|
||
|
|
|
||
|
|
Sound sentences:
|
||
|
|
|
||
|
|
- the archive proves the records it holds were not altered or truncated after arrival
|
||
|
|
- absence of a record is not evidence of non-occurrence
|
||
|
|
|
||
|
|
Unsound sentences, not used here:
|
||
|
|
|
||
|
|
- the audit record proves it happened
|
||
|
|
- there is no record, so it did not happen
|
||
|
|
- the trail is complete
|
||
|
|
|
||
|
|
## Classification
|
||
|
|
|
||
|
|
| Kind | Test | Local form |
|
||
|
|
| --- | --- | --- |
|
||
|
|
| **Load-bearing** | a control's soundness depends on the event being present | authorization denials; `account.status_changed`; `tenant_account.status_changed`; `prepared_account.revoked`; `family_invitation.revoked` |
|
||
|
|
| **Attributive** | forensic reconstruction; no control branches on presence | user/profile/membership-added/catalog/registration/hat events |
|
||
|
|
| **Heartbeat** | positive claim that can itself go missing | `user_engine.evidence.heartbeat` |
|
||
|
|
|
||
|
|
Successful mutations enqueue local audit and outbox in the same store
|
||
|
|
transaction. That prevents accidental omission (crash between save and
|
||
|
|
emit) of the *local* record. Drain to `audit-core` is after commit.
|
||
|
|
|
||
|
|
## Cadence
|
||
|
|
|
||
|
|
Rate monitoring cannot detect suppression of rare denials and
|
||
|
|
revocations. The required form is a **heartbeat**:
|
||
|
|
`UserEngineService.record_evidence_heartbeat()` emits a positive claim
|
||
|
|
with counts of load-bearing classes already on the local trail. The
|
||
|
|
payload sets `completeness_claimed: false`. Expected interval: one hour
|
||
|
|
when a drain loop is running. The heartbeat is the claim that can go
|
||
|
|
missing; it is not a completeness proof.
|
||
|
|
|
||
|
|
Adversarial omission at a compromised source is a known residual.
|
||
|
|
Nothing in this model prevents it.
|