{ "version": "certarail.production-security-controls.v1", "title": "CertaRail production testable security controls", "status": "REQUIRES_ACTIVATION", "productionReady": false, "authority": "TARGET_PRODUCTION_CONTROL_AND_VERIFICATION_PLAN", "currentBoundary": "This contract turns A22.3 into traceable threats, controls, test cases, evidence locators, exercises and activation gates. Existing repository checks prove selected Local/sandbox behavior only. Production-like evidence, observed restores, incident drills, external audit infrastructure, independent assessment and signed activation have not been performed by this artifact.", "sourceContract": "The user-provided A15–A22 report requirements are the acceptance source. The contract also extends certarail.production-iam-design.v1 and certarail.production-network-secrets-design.v1 and links current repository tests without changing their proof boundary.", "dependencies": { "iam": "certarail.production-iam-design.v1", "networkAndSecrets": "certarail.production-network-secrets-design.v1", "apiThreatBaseline": "OWASP_API_SECURITY_TOP_10_2023" }, "controls": { "apiThreatModel": { "methodology": "OWASP_API_SECURITY_TOP_10_2023_PLUS_CERTARAIL_ABUSE_CASES", "scope": "Every public, partner, internal, administration, webhook, worker, export and recovery API in all canonical environments.", "assets": [ "Tenant identity, organization binding, scopes, roles and approval state", "Authoritative policy, decision, idempotency, ledger, movement and provider state", "Credentials, signing/encryption key references and revocation state", "Audit, evidence, outbox/inbox, webhook and recovery artifacts", "Availability, per-tenant fairness and production activation authority" ], "trustBoundaries": [ "Browser or partner client to approved edge/BFF/API gateway", "Gateway to control-plane API and authorization decision point", "Application runtime to PostgreSQL, cache, Kafka, Temporal and object storage", "Webhook/provider ingress and controlled outbound delivery/adapter egress", "Human administration to private JIT management and break-glass planes", "Production to backup, DR, restore and independent-review environments" ], "adversaries": [ "Unauthenticated internet client", "Authenticated user or workload exceeding its tenant/resource authority", "Compromised tenant administrator, support principal or service credential", "Malicious or compromised provider/webhook endpoint", "Insider with partial database, log, KMS, Vault or deployment access", "Automated abuse causing cost, queue, parser, connection or storage exhaustion" ], "risks": [ { "id": "API1:2023", "name": "Broken Object Level Authorization", "assets": [ "Tenant resources", "Evidence and exports" ], "trustBoundaries": [ "Client to API", "Worker to data store" ], "abuseCase": "A valid principal substitutes another tenant resource ID or causes a background/export job to load it.", "controlIds": [ "AUTHZ-001", "TENANT-001", "AUDIT-001" ], "testCaseIds": [ "AUTHZ-POSITIVE-OWN-OBJECT", "AUTHZ-NEGATIVE-CROSS-OBJECT", "AUTHZ-NEGATIVE-TENANT-CONFLICT" ] }, { "id": "API2:2023", "name": "Broken Authentication", "assets": [ "Human sessions", "Workload and service identities" ], "trustBoundaries": [ "Client to IdP/edge", "Workload to API" ], "abuseCase": "An attacker reuses expired, revoked, wrong-audience or confused principal-type credentials.", "controlIds": [ "AUTHN-001", "AUDIT-001" ], "testCaseIds": [ "AUTHN-NEGATIVE-MISSING", "AUTHN-NEGATIVE-INVALID", "AUTHZ-NEGATIVE-REVOKED", "AUTHZ-NEGATIVE-IDENTITY-CONFUSION" ] }, { "id": "API3:2023", "name": "Broken Object Property Level Authorization", "assets": [ "Protected command fields", "Restricted response properties" ], "trustBoundaries": [ "JSON/schema boundary", "Domain to projection" ], "abuseCase": "A caller over-posts tenant/owner/status/approval fields or receives properties outside its relationship.", "controlIds": [ "AUTHZ-002", "CONFIG-001" ], "testCaseIds": [ "AUTHZ-NEGATIVE-PROPERTY" ] }, { "id": "API4:2023", "name": "Unrestricted Resource Consumption", "assets": [ "Availability", "Per-tenant fairness", "Cost budgets" ], "trustBoundaries": [ "Edge to parser", "Runtime to dependencies" ], "abuseCase": "A client exhausts bytes, parsing, concurrency, database, export, queue, retry or paid-provider budgets.", "controlIds": [ "RESOURCE-001", "AUDIT-001" ], "testCaseIds": [ "RESOURCE-BODY-LIMIT", "RESOURCE-CONCURRENCY-LIMIT", "RESOURCE-DEADLINE", "RESOURCE-PAGE-EXPORT-LIMIT", "RESOURCE-TENANT-COST-BUDGET", "RESOURCE-DATABASE-BUDGET", "RESOURCE-RETRY-AMPLIFICATION" ] }, { "id": "API5:2023", "name": "Broken Function Level Authorization", "assets": [ "Privileged operations", "Approval and activation authority" ], "trustBoundaries": [ "Route to PDP", "Operator to management plane" ], "abuseCase": "A lower-privilege principal calls an administrative function or self-approves a privileged action.", "controlIds": [ "AUTHZ-002", "AUDIT-001" ], "testCaseIds": [ "AUTHZ-NEGATIVE-SCOPE", "AUTHZ-NEGATIVE-SELF-APPROVAL" ] }, { "id": "API6:2023", "name": "Unrestricted Access to Sensitive Business Flows", "assets": [ "Onboarding", "Approval", "Replay", "Webhook and activation flows" ], "trustBoundaries": [ "Public flow to authoritative command service" ], "abuseCase": "Automation races or repeats a state-changing flow, bypasses ordering or consumes an unbounded business resource.", "controlIds": [ "FLOW-001", "RESOURCE-001", "AUDIT-001" ], "testCaseIds": [ "FLOW-REPLAY-CONFLICT", "RESOURCE-TENANT-COST-BUDGET" ] }, { "id": "API7:2023", "name": "Server Side Request Forgery", "assets": [ "Private services", "Metadata endpoints", "Provider credentials" ], "trustBoundaries": [ "API to webhook/provider egress" ], "abuseCase": "A configured URL reaches a private, link-local or redirected destination outside the approved provider profile.", "controlIds": [ "SSRF-001", "CONFIG-001" ], "testCaseIds": [ "SSRF-DESTINATION-ESCAPE" ] }, { "id": "API8:2023", "name": "Security Misconfiguration", "assets": [ "All protected API and control-plane surfaces" ], "trustBoundaries": [ "Build/configuration to runtime" ], "abuseCase": "A missing setting activates debug routes, permissive origins, plaintext transport, verbose errors or excess privileges.", "controlIds": [ "CONFIG-001", "INVENTORY-001", "AUDIT-001" ], "testCaseIds": [ "CONFIG-FAIL-CLOSED", "INVENTORY-ROUTE-DRIFT" ] }, { "id": "API9:2023", "name": "Improper Inventory Management", "assets": [ "API versions", "Route ownership", "Environment boundaries" ], "trustBoundaries": [ "Canonical contracts to deployed routes" ], "abuseCase": "A stale, shadow, undocumented or lower-environment endpoint remains reachable without current controls.", "controlIds": [ "INVENTORY-001", "CONFIG-001" ], "testCaseIds": [ "INVENTORY-ROUTE-DRIFT" ] }, { "id": "API10:2023", "name": "Unsafe Consumption of APIs", "assets": [ "Authoritative state", "Provider/webhook evidence", "Availability" ], "trustBoundaries": [ "External provider/webhook to adapter/inbox" ], "abuseCase": "Authenticated third-party data is trusted without schema, size, semantic, deadline, replay or provenance validation.", "controlIds": [ "DEPENDENCY-001", "RESOURCE-001", "AUDIT-001" ], "testCaseIds": [ "DEPENDENCY-UNTRUSTED-RESPONSE", "RESOURCE-DEADLINE", "RESOURCE-RETRY-AMPLIFICATION" ] } ] }, "controlCatalog": [ { "id": "AUTHN-001", "title": "Trusted identity validation", "owner": "Identity Platform", "enforcement": "Validate issuer, audience, signature, time bounds, credential binding, client/workload status and revocation before a route is disclosed.", "verification": "Positive identity plus missing, malformed, expired, wrong-issuer, wrong-audience, revoked and identity-confusion cases.", "productionStatus": "OPEN" }, { "id": "AUTHZ-001", "title": "Object and tenant authorization", "owner": "Application Security", "enforcement": "Derive tenant, organization, subject and resource scope from trusted identity; apply the same predicate on reads, writes, exports and background work.", "verification": "Own-object allow plus cross-object, cross-tenant, guessed-ID, batch and indirect-reference denial without existence leakage.", "productionStatus": "OPEN" }, { "id": "AUTHZ-002", "title": "Function and property authorization", "owner": "Application Security", "enforcement": "Route-level scope/RBAC/relationship policy and explicit request/response property allowlists; privileged mutations require maker-checker where declared.", "verification": "Role/scope matrix, over-posting, under-filtered response, self-approval and service-versus-human confusion tests.", "productionStatus": "OPEN" }, { "id": "TENANT-001", "title": "Layered tenant isolation", "owner": "Platform Security", "enforcement": "Enforce tenant identity at HTTP, domain, PostgreSQL FORCE RLS, cache, Kafka, worker, audit/export, support and recovery layers.", "verification": "Two-tenant positive/negative matrix through public seams and a non-owner, non-BYPASSRLS runtime database role.", "productionStatus": "OPEN" }, { "id": "RESOURCE-001", "title": "Bounded resource consumption", "owner": "SRE", "enforcement": "Bound bytes, parsed fields, pages, exports, concurrency, deadlines, database cost, retries, queues and tenant/business budgets before expensive work.", "verification": "Boundary, limit-plus-one, slow-body, concurrency-storm, expensive-query and retry-amplification tests with bounded overload outcomes.", "productionStatus": "OPEN" }, { "id": "FLOW-001", "title": "Sensitive business-flow abuse defence", "owner": "Product Security", "enforcement": "Require server-derived state, idempotency, quotas, approval separation, risk signals and replay-safe recovery on sensitive workflows.", "verification": "Duplicate, changed-payload, parallel, stale-approval, quota exhaustion and bypass-sequence tests.", "productionStatus": "OPEN" }, { "id": "SSRF-001", "title": "Controlled outbound destinations", "owner": "Platform Security", "enforcement": "Exact destination profiles, controlled DNS resolution, private/link-local/metadata denial, no redirects and identity-aware egress.", "verification": "IPv4/IPv6, redirect, DNS-rebinding, userinfo, alternate-port and cloud-metadata negative tests.", "productionStatus": "OPEN" }, { "id": "CONFIG-001", "title": "Hardened API configuration", "owner": "Platform Engineering", "enforcement": "Fail-closed configuration, production-safe errors and headers, exact CORS/TLS policy, disabled diagnostics and least-privilege runtime identities.", "verification": "Missing/invalid configuration, debug-route, verbose-error, header, CORS, TLS and runtime-privilege tests.", "productionStatus": "OPEN" }, { "id": "INVENTORY-001", "title": "Authoritative API inventory", "owner": "API Platform", "enforcement": "Every reachable route, version, environment, operation and event is owned by a canonical contract and deprecation lifecycle.", "verification": "Runtime route-to-contract reconciliation, unknown route denial, stale version detection and orphan/deprecated endpoint checks.", "productionStatus": "OPEN" }, { "id": "DEPENDENCY-001", "title": "Unsafe API consumption defence", "owner": "Integration Engineering", "enforcement": "Treat provider input as untrusted; authenticate source, validate schema/size/status, bound time/retries and quarantine ambiguous responses.", "verification": "Malformed, oversized, delayed, duplicated, conflicting, downgraded and partially authenticated provider-response tests.", "productionStatus": "OPEN" }, { "id": "AUDIT-001", "title": "Tamper-evident security audit", "owner": "Security Operations", "enforcement": "Emit schema-valid, append-only, integrity-protected decision records to a separately administered production sink without credential or payload leakage.", "verification": "Required-field, tamper, gap, duplicate, clock-skew, access, backpressure, cross-tenant and secret-canary tests.", "productionStatus": "OPEN" }, { "id": "RECOVERY-001", "title": "Verified recovery", "owner": "SRE", "enforcement": "Restore immutable backups into an isolated production-like environment and reconcile authority, idempotency, audit, ledger, outbox and evidence invariants.", "verification": "Observed restore and failover exercises measured against an approved BIA/SLO; backup creation alone is insufficient.", "productionStatus": "OPEN" } ], "testCases": [ { "id": "AUTHZ-POSITIVE-OWN-OBJECT", "family": "AUTHORIZATION", "stimulus": "Authorized principal uses the declared scope on its own tenant object.", "expectedStatus": 200, "expectation": "The exact allowed projection is returned and the permit decision is audited.", "level": "PRODUCTION_LIKE" }, { "id": "AUTHN-NEGATIVE-MISSING", "family": "AUTHORIZATION", "stimulus": "Omit the required credential.", "expectedStatus": 401, "expectation": "Fail before handler execution and emit no protected metadata.", "level": "REPOSITORY_AND_PRODUCTION_LIKE" }, { "id": "AUTHN-NEGATIVE-INVALID", "family": "AUTHORIZATION", "stimulus": "Use malformed, expired, wrong-issuer, wrong-audience or invalid-signature material.", "expectedStatus": 401, "expectation": "Every credential class fails closed with a bounded public error and reason-coded audit record.", "level": "PRODUCTION_LIKE" }, { "id": "AUTHZ-NEGATIVE-SCOPE", "family": "AUTHORIZATION", "stimulus": "Use a valid identity without the required operation scope or role.", "expectedStatus": 403, "expectation": "No domain method or downstream dependency is invoked.", "level": "REPOSITORY_AND_PRODUCTION_LIKE" }, { "id": "AUTHZ-NEGATIVE-CROSS-OBJECT", "family": "AUTHORIZATION", "stimulus": "Tenant A requests a valid resource identifier that belongs to tenant B.", "expectedStatus": 404, "expectation": "Deny before side effects and preserve the endpoint existence-hiding policy.", "level": "REPOSITORY_AND_PRODUCTION_LIKE" }, { "id": "AUTHZ-NEGATIVE-PROPERTY", "family": "AUTHORIZATION", "stimulus": "Add tenant, owner, role, status, approval or internal routing fields to a request.", "expectedStatus": 400, "expectation": "Reject unknown/protected properties; response filtering never discloses unauthorized fields.", "level": "REPOSITORY_AND_PRODUCTION_LIKE" }, { "id": "AUTHZ-NEGATIVE-SELF-APPROVAL", "family": "AUTHORIZATION", "stimulus": "The maker attempts to approve its own privileged operation.", "expectedStatus": 403, "expectation": "Approval requires two distinct principals and cannot be satisfied by role aliasing or session replacement.", "level": "REPOSITORY_AND_PRODUCTION_LIKE" }, { "id": "AUTHZ-NEGATIVE-IDENTITY-CONFUSION", "family": "AUTHORIZATION", "stimulus": "A workload credential calls a human-only route or a human session calls a workload-only operation.", "expectedStatus": 403, "expectation": "Principal type, client/workload identity and authentication context remain authorization inputs.", "level": "PRODUCTION_LIKE" }, { "id": "AUTHZ-NEGATIVE-TENANT-CONFLICT", "family": "AUTHORIZATION", "stimulus": "A valid identity supplies a conflicting tenant in path, query, body or forwarding header.", "expectedStatus": 403, "expectation": "The trusted server binding wins; the conflicting assertion is rejected and never becomes scope.", "level": "REPOSITORY_AND_PRODUCTION_LIKE" }, { "id": "AUTHZ-NEGATIVE-REVOKED", "family": "AUTHORIZATION", "stimulus": "Reuse a revoked session, token family, client or workload certificate.", "expectedStatus": 401, "expectation": "Use is denied within the A22.1/A22.2 propagation SLA and linked to revocation evidence.", "level": "PRODUCTION_LIKE" }, { "id": "RESOURCE-BODY-LIMIT", "family": "RESOURCE_CONSUMPTION", "stimulus": "Send limit-plus-one bytes and a slow/chunked body.", "expectedStatus": 413, "expectation": "Reject before expensive parsing or service execution; memory and goroutines remain bounded.", "level": "REPOSITORY_AND_PRODUCTION_LIKE" }, { "id": "RESOURCE-CONCURRENCY-LIMIT", "family": "RESOURCE_CONSUMPTION", "stimulus": "Hold all admission slots and send one additional request.", "expectedStatus": 429, "expectation": "Reject immediately with Retry-After; do not queue unbounded work.", "level": "REPOSITORY_AND_PRODUCTION_LIKE" }, { "id": "RESOURCE-DEADLINE", "family": "RESOURCE_CONSUMPTION", "stimulus": "Delay a dependency beyond the operation deadline.", "expectedStatus": 503, "expectation": "Cancel downstream work, preserve idempotency and expose a retry-safe bounded outcome.", "level": "REPOSITORY_AND_PRODUCTION_LIKE" }, { "id": "RESOURCE-PAGE-EXPORT-LIMIT", "family": "RESOURCE_CONSUMPTION", "stimulus": "Request a page/export above the declared row and byte budgets.", "expectedStatus": 400, "expectation": "Reject or clamp only where the contract declares clamping; no unbounded scan or response is created.", "level": "PRODUCTION_LIKE" }, { "id": "RESOURCE-TENANT-COST-BUDGET", "family": "RESOURCE_CONSUMPTION", "stimulus": "Exhaust a tenant, credential and sensitive-flow cost budget.", "expectedStatus": 429, "expectation": "The named tenant is throttled without starving other tenants; reset and override are audited.", "level": "PRODUCTION_LIKE" }, { "id": "RESOURCE-DATABASE-BUDGET", "family": "RESOURCE_CONSUMPTION", "stimulus": "Trigger pool saturation, statement timeout and lock timeout.", "expectedStatus": 503, "expectation": "Reserved control capacity remains available and no cascading connection growth occurs.", "level": "PRODUCTION_LIKE" }, { "id": "RESOURCE-RETRY-AMPLIFICATION", "family": "RESOURCE_CONSUMPTION", "stimulus": "Return repeated retryable delivery failures until the attempt budget is exhausted.", "expectedStatus": 202, "expectation": "Backoff, deadline, attempt cap, quarantine and operator recovery remain bounded and durable.", "level": "REPOSITORY_AND_PRODUCTION_LIKE" }, { "id": "FLOW-REPLAY-CONFLICT", "family": "BUSINESS_FLOW", "stimulus": "Reuse an idempotency key with changed protected input and race parallel duplicates.", "expectedStatus": 409, "expectation": "Exactly one effect is committed; changed input fails and exact input replays the original result.", "level": "REPOSITORY_AND_PRODUCTION_LIKE" }, { "id": "SSRF-DESTINATION-ESCAPE", "family": "OUTBOUND_SECURITY", "stimulus": "Attempt private, loopback, link-local, metadata, redirect, DNS-rebinding or alternate-port destinations.", "expectedStatus": 400, "expectation": "No connection is attempted outside the exact approved destination profile.", "level": "PRODUCTION_LIKE" }, { "id": "CONFIG-FAIL-CLOSED", "family": "CONFIGURATION", "stimulus": "Remove or corrupt mandatory production security configuration.", "expectedStatus": 503, "expectation": "Readiness stays closed; diagnostics, permissive CORS and plaintext fallbacks remain unavailable.", "level": "REPOSITORY_AND_PRODUCTION_LIKE" }, { "id": "INVENTORY-ROUTE-DRIFT", "family": "INVENTORY", "stimulus": "Add a reachable route/version without its canonical contract and owner.", "expectedStatus": 500, "expectation": "The release gate fails before deployment.", "level": "REPOSITORY_AND_PRODUCTION_LIKE" }, { "id": "DEPENDENCY-UNTRUSTED-RESPONSE", "family": "DEPENDENCY_SECURITY", "stimulus": "Return an authenticated but malformed, oversized, conflicting or delayed provider response.", "expectedStatus": 502, "expectation": "No authoritative success is invented; the response is rejected or quarantined with bounded evidence.", "level": "PRODUCTION_LIKE" }, { "id": "AUDIT-TAMPER-AND-LEAK", "family": "AUDIT", "stimulus": "Mutate/delete/reorder an event and inject credential, PII and raw-payload canaries.", "expectedStatus": 500, "expectation": "Integrity verification fails and prohibited values never reach the production sink.", "level": "REPOSITORY_AND_PRODUCTION_LIKE" }, { "id": "RECOVERY-RESTORE-INVARIANTS", "family": "RECOVERY", "stimulus": "Restore to an approved point and rebuild disposable projections.", "expectedStatus": 200, "expectation": "Measured RPO/RTO and all authority, audit, ledger, idempotency, outbox and evidence invariants pass.", "level": "PRODUCTION_LIKE" } ], "tenantIsolation": { "crossTenantFixtureCount": 2, "fixtureRule": "Create tenant A and tenant B with distinct organizations, principals, resources, idempotency keys, cache entries, topic identities, jobs, audit records and backup samples.", "database": { "runtimeRoleOwnsTables": false, "runtimeRoleBypassRls": false, "forceRlsRequired": true, "context": "SET LOCAL certarail.tenant_id inside every transaction; missing or malformed context fails closed." }, "layers": [ { "id": "HTTP_TRANSPORT", "positiveAssertion": "Tenant A can use its own path/query/body/header combination only where the contract allows it.", "negativeAssertion": "Every caller-selected conflicting tenant/organization/subject value is rejected before service invocation.", "evidenceRequired": [ "HTTP transcript", "service-spy assertion", "audit decision" ], "productionStatus": "OPEN" }, { "id": "DOMAIN_SERVICE", "positiveAssertion": "Trusted scope is passed explicitly into repositories and dependent services.", "negativeAssertion": "A mismatched aggregate, relationship, approval or replay owner cannot transition state.", "evidenceRequired": [ "focused domain test", "state diff", "side-effect count" ], "productionStatus": "OPEN" }, { "id": "POSTGRES_RLS", "positiveAssertion": "A non-owner runtime role reads/writes rows only with matching SET LOCAL tenant context.", "negativeAssertion": "Missing context, tenant B access, WITH CHECK violation and attempted RLS bypass all fail.", "evidenceRequired": [ "role grants", "FORCE RLS inventory", "live two-tenant SQL transcript" ], "productionStatus": "OPEN" }, { "id": "CACHE", "positiveAssertion": "Cache namespace and signed envelope bind environment, tenant, resource, policy version and authority epoch.", "negativeAssertion": "Tenant B, stale epoch, wrong key ID and moved raw key/value cannot produce authority or a cache hit.", "evidenceRequired": [ "key-shape test", "envelope verification", "cold-cache result" ], "productionStatus": "OPEN" }, { "id": "KAFKA", "positiveAssertion": "Producer/consumer identity, topic ACL, partition key and envelope carry the same tenant/environment binding.", "negativeAssertion": "Cross-tenant topic access, envelope mismatch and unauthorized replay are denied or quarantined.", "evidenceRequired": [ "broker ACL export", "negative publish/consume transcript", "quarantine evidence" ], "productionStatus": "OPEN" }, { "id": "BACKGROUND_WORK", "positiveAssertion": "Outbox, workflow, retry, scan and export jobs rehydrate signed tenant scope from durable state.", "negativeAssertion": "A queue payload alone cannot select tenant/resource or redirect an effect.", "evidenceRequired": [ "job envelope", "restart test", "cross-tenant poison-message test" ], "productionStatus": "OPEN" }, { "id": "AUDIT_AND_EXPORT", "positiveAssertion": "Audit/search/export requires tenant-aware authorization and records exact selection criteria.", "negativeAssertion": "Batch, pagination, alias/correlation lookup and downloadable evidence never cross tenant boundaries.", "evidenceRequired": [ "export manifest", "negative lookup tests", "audit access event" ], "productionStatus": "OPEN" }, { "id": "PRIVILEGED_SUPPORT", "positiveAssertion": "JIT support access names one tenant, reason, ticket, command allowlist and expiry.", "negativeAssertion": "Standing, global, self-approved or expired support access is denied.", "evidenceRequired": [ "PAM grant", "two-person approval", "session recording metadata", "post-review" ], "productionStatus": "OPEN" }, { "id": "BACKUP_AND_RESTORE", "positiveAssertion": "Restore preserves tenant keys/policies and validation can sample each tenant independently.", "negativeAssertion": "Restore tooling cannot copy production tenant data/secrets into a lower environment or expose a cross-tenant export.", "evidenceRequired": [ "restore manifest", "environment attestations", "two-tenant verification" ], "productionStatus": "OPEN" } ] }, "resourceConsumption": [ { "id": "REQUEST_BODY_BYTES", "metric": "HTTP request bytes and parse allocations", "currentRepositoryControl": "Generic JSON 1 MiB; checkout JSON 64 KiB; strict single-object decoder with unknown fields rejected.", "limitSource": "Versioned operation contract; edge limit must be equal to or stricter than the application limit.", "overloadOutcome": "Reject before service execution with a bounded 4xx response and no body echo.", "testCaseIds": [ "RESOURCE-BODY-LIMIT" ], "productionStatus": "OPEN" }, { "id": "UPLOAD_BYTES", "metric": "Upload bytes, media type, scan bytes and storage reservation", "currentRepositoryControl": "Signed fixed Content-Length, allowlisted media type and 10 MiB maximum in the Local document workflow.", "limitSource": "Approved document class policy plus capacity and malware-scanner envelope.", "overloadOutcome": "Reject before persistence; partial bytes never become an accepted document.", "testCaseIds": [ "RESOURCE-BODY-LIMIT" ], "productionStatus": "OPEN" }, { "id": "REQUEST_CONCURRENCY", "metric": "In-flight requests and service operations by route class and tenant", "currentRepositoryControl": "Bounded eligibility and control-plane semaphores; saturation returns 429 with Retry-After.", "limitSource": "Measured capacity test and per-tenant fairness policy.", "overloadOutcome": "Immediate 429; no unbounded queue or goroutine allocation.", "testCaseIds": [ "RESOURCE-CONCURRENCY-LIMIT" ], "productionStatus": "OPEN" }, { "id": "OPERATION_DEADLINE", "metric": "End-to-end and downstream operation duration", "currentRepositoryControl": "Eligibility defaults to 2 seconds; control-plane operations default to 10 seconds and propagate cancellation.", "limitSource": "Operation SLO with a smaller downstream budget and explicit retry/idempotency semantics.", "overloadOutcome": "Cancel work, preserve ambiguous-outcome recovery and return a retry-safe bounded error.", "testCaseIds": [ "RESOURCE-DEADLINE" ], "productionStatus": "OPEN" }, { "id": "PAGINATION_AND_EXPORT", "metric": "Rows scanned, rows returned, encoded bytes and export duration", "currentRepositoryControl": "Selected current endpoints cap arrays/pages; no repository-wide production export budget is proven.", "limitSource": "Per-operation OpenAPI limit plus approved asynchronous export profile.", "overloadOutcome": "Reject over-limit synchronous export; use authorized bounded async artifact creation where designed.", "testCaseIds": [ "RESOURCE-PAGE-EXPORT-LIMIT" ], "productionStatus": "OPEN" }, { "id": "TENANT_RATE_AND_COST_BUDGET", "metric": "Requests, sensitive actions, provider calls and cost units per tenant/credential/principal", "currentRepositoryControl": "Hosted sandbox credential has fixed request/reset budgets; this is not a production distributed limiter.", "limitSource": "Approved product entitlement and abuse-risk policy.", "overloadOutcome": "429 with durable reason and reset metadata; protected control capacity remains available.", "testCaseIds": [ "RESOURCE-TENANT-COST-BUDGET" ], "productionStatus": "OPEN" }, { "id": "DATABASE_BUDGET", "metric": "Pool wait, active connections, statement time, lock time, rows and temporary bytes", "currentRepositoryControl": "Write admission and bounded SQL shapes exist; production pool/statement/lock budgets require measured configuration.", "limitSource": "PostgreSQL HA/DR connection budget and per-workload capacity plan.", "overloadOutcome": "Backpressure before commit; reserved migrator, monitoring and emergency capacity is not consumed.", "testCaseIds": [ "RESOURCE-DATABASE-BUDGET" ], "productionStatus": "OPEN" }, { "id": "OUTBOX_AND_WEBHOOK_BUDGET", "metric": "Backlog bytes/age, leases, attempts, retry horizon and per-destination concurrency", "currentRepositoryControl": "Bounded backoff, deadlines, attempt caps, quarantine and write admission are covered by repository tests.", "limitSource": "Destination SLO, broker capacity and durable storage high-water policy.", "overloadOutcome": "Stop new affected writes where durability is at risk; quarantine terminal work without deleting evidence.", "testCaseIds": [ "RESOURCE-RETRY-AMPLIFICATION" ], "productionStatus": "OPEN" }, { "id": "DECOMPRESSION_AND_PARSER_BUDGET", "metric": "Expanded bytes, nesting, tokens, fields and parser CPU", "currentRepositoryControl": "Strict JSON and bounded payloads exist; no universal compressed-input policy is proven.", "limitSource": "Media-type-specific parser profile with compressed input disabled unless explicitly required.", "overloadOutcome": "Reject unsupported encoding, excessive expansion/depth/fields or parser deadline before durable work.", "testCaseIds": [ "RESOURCE-BODY-LIMIT", "RESOURCE-DEADLINE" ], "productionStatus": "OPEN" } ], "auditLog": { "schema": "certarail.security-audit-event.v1", "requiredFields": [ "event_id", "schema_version", "occurred_at", "recorded_at", "tenant_id", "environment", "actor_id", "actor_type", "issuer", "client_or_workload_id", "authentication_context", "action", "resource_type", "resource_id_digest", "decision", "reason_code", "policy_version", "request_id", "trace_id", "idempotency_key_digest", "evidence_digest", "previous_event_digest", "event_digest" ], "conditionalFields": [ "organization_id", "subject_ref_digest", "maker_actor_id", "checker_actor_id", "change_or_incident_ticket", "source_network_zone", "credential_id_digest", "before_digest", "after_digest" ], "forbiddenFields": [ "bearer_token", "cookie", "private_key", "secret_value", "raw_document", "request_body", "url_query", "plaintext_personal_data", "recoverable_credential" ], "events": [ "Authentication success/failure and credential lifecycle", "Authorization permit/deny including policy/reason and protected operation", "Privileged request, approval, execution, expiry and break-glass review", "Tenant/security configuration and production activation changes", "Secret/key create, use metadata, rotate, revoke, disable and recovery", "Evidence/export access, deletion request, legal hold and retention action", "Rate/quota/backpressure decisions and security-control degradation", "Backup, restore, failover, incident and independent-review evidence changes" ], "integrity": "Canonical event digest plus predecessor/segment manifest; signed immutable export with sequence/gap verification and separately administered time source.", "access": "Dedicated least-privilege writer, security reader and independent auditor; application administrators cannot alter retention or historical events.", "productionSink": "EXTERNAL_APPEND_ONLY_WORM_OR_EQUIVALENT", "siem": "Metadata-only routed events with rule/version ownership, delivery acknowledgement, lag/gap alerting and dead-letter recovery.", "retention": "Approved per event/data class with residency, legal hold and cryptographic-erasure dependencies; not fixed by this repository contract.", "legallyMaterialCommandOnAuditFailure": "FAIL_CLOSED", "readOnlyOperationOnAuditFailure": "Explicit route policy; protected exports, privileged reads and evidence access fail closed.", "testCaseIds": [ "AUDIT-TAMPER-AND-LEAK" ], "productionStatus": "OPEN" }, "incidents": [ { "id": "COMPROMISED_HUMAN_SESSION", "inject": "Use a canary human session after refresh-family revoke.", "detect": [ "revoked-use signal", "impossible/risky session correlation" ], "contain": [ "terminate session family", "remove JIT grants", "block affected principal" ], "recover": [ "reauthenticate strongly", "review protected actions", "rotate affected credentials" ], "assertions": [ "revocation SLA met", "no new protected action", "complete timeline" ], "evidenceRequired": [ "IdP event", "PDP denial", "audit timeline", "incident owner receipt" ] }, { "id": "COMPROMISED_SERVICE_IDENTITY", "inject": "Use an old workload certificate/client after emergency revoke.", "detect": [ "certificate/client anomaly", "revoked-use attempt" ], "contain": [ "revoke identity", "deny workload policy", "isolate workload/network path" ], "recover": [ "issue new bound identity", "redeploy clean artifact", "reconcile commands" ], "assertions": [ "old identity denied", "new identity least-privileged", "ambiguous effects reconciled" ], "evidenceRequired": [ "CA/IdP record", "network denial", "deployment digest", "reconciliation report" ] }, { "id": "CROSS_TENANT_ACCESS", "inject": "Attempt API, RLS, cache, Kafka, worker and export access from tenant A to tenant B.", "detect": [ "deny and anomaly signals", "RLS/policy violations" ], "contain": [ "block principal/client", "freeze affected export/workers", "preserve evidence" ], "recover": [ "verify all isolation layers", "notify per approved plan", "retest fixed path" ], "assertions": [ "zero unauthorized disclosure/effect", "scope of exposure determined", "negative retest passes" ], "evidenceRequired": [ "two-tenant transcript", "data-access query", "audit/SIEM timeline", "review decision" ] }, { "id": "RESOURCE_EXHAUSTION", "inject": "Generate bounded body, concurrency, page, database, queue and retry pressure.", "detect": [ "saturation and fairness SLO alerts", "cost/quota anomaly" ], "contain": [ "tenant/credential throttle", "load shedding", "destination circuit/open admission gate" ], "recover": [ "drain bounded backlog", "reconcile dropped/retried work", "restore normal limits under approval" ], "assertions": [ "other tenants remain within SLO", "no unbounded growth", "idempotency preserved" ], "evidenceRequired": [ "load profile", "resource graphs", "queue reconciliation", "limit-change audit" ] }, { "id": "WEBHOOK_OR_SSRF_COMPROMISE", "inject": "Use invalid/rotated signatures and an endpoint resolving outside its approved profile.", "detect": [ "signature failure", "destination-policy denial", "delivery anomaly" ], "contain": [ "pause endpoint", "revoke key", "deny egress profile" ], "recover": [ "verify endpoint again", "rotate key", "replay only exact approved events" ], "assertions": [ "no disallowed connection", "old key denied", "replay is exact and audited" ], "evidenceRequired": [ "DNS/egress decision", "key lifecycle", "delivery journal", "replay receipt" ] }, { "id": "KMS_OR_VAULT_OUTAGE_COMPROMISE", "inject": "Deny KMS/Vault access or disable an environment key/secret lease.", "detect": [ "lease/crypto failure", "decrypt/sign error budget alert" ], "contain": [ "fail closed", "isolate affected identity/key", "invoke two-person recovery" ], "recover": [ "restore approved service", "rotate exposed material", "verify old/new negative use" ], "assertions": [ "no plaintext fallback", "no cross-environment key use", "custody separation preserved" ], "evidenceRequired": [ "KMS/Vault audit", "PAM approvals", "rotation/revocation evidence", "service reconciliation" ] }, { "id": "POSTGRES_FAILOVER_OR_CORRUPTION", "inject": "Fence a primary or restore to a selected pre-corruption point.", "detect": [ "quorum/lag/archive/invariant alert", "authority epoch change" ], "contain": [ "close writes", "fence old primary", "block external publication" ], "recover": [ "promote or PITR", "rebuild cache", "reconcile audit/ledger/idempotency/outbox" ], "assertions": [ "one writer", "measured RPO/RTO", "all invariants pass" ], "evidenceRequired": [ "fencing proof", "LSN/timeline manifest", "invariant report", "traffic-reopen approval" ] }, { "id": "KAFKA_BACKLOG_OR_POISON_EVENT", "inject": "Publish a schema-invalid/tenant-mismatched canary and stop consumer progress.", "detect": [ "schema/ACL rejection", "lag and oldest-age alert", "poison retry signal" ], "contain": [ "quarantine event", "pause affected partition/consumer", "preserve outbox truth" ], "recover": [ "fix consumer/config", "resume from durable watermark", "reconcile outbox/inbox" ], "assertions": [ "ordering preserved", "no duplicate side effect", "unaffected partitions continue" ], "evidenceRequired": [ "broker ACL/schema record", "lag graph", "quarantine artifact", "reconciliation" ] }, { "id": "AUDIT_GAP_OR_TAMPER", "inject": "Remove, reorder or mutate a canary event and delay sink delivery.", "detect": [ "digest/sequence/gap failure", "sink lag alert" ], "contain": [ "freeze affected privileged actions", "preserve source segments", "restrict log access" ], "recover": [ "re-export immutable segment", "reconcile source-of-truth events", "document any irrecoverable gap" ], "assertions": [ "tamper is detectable", "gap is not silently accepted", "secrets remain absent" ], "evidenceRequired": [ "verification report", "source/sink manifests", "access logs", "incident decision" ] }, { "id": "SUPPLY_CHAIN_OR_CONFIG_TAMPER", "inject": "Attempt to deploy an unsigned/unknown digest or drifted security configuration.", "detect": [ "provenance/policy failure", "runtime config drift alert" ], "contain": [ "block rollout", "revoke artifact/identity", "isolate affected workload" ], "recover": [ "redeploy approved digest", "rotate exposed credentials", "reconcile runtime state" ], "assertions": [ "unknown artifact never receives traffic", "rollback is controlled", "new digest attested" ], "evidenceRequired": [ "SBOM/provenance", "policy decision", "deployment record", "post-incident verification" ] }, { "id": "IDP_OR_PDP_OUTAGE", "inject": "Make the production IdP/JWKS or authorization decision point unavailable/stale.", "detect": [ "freshness/fetch/PDP availability alert", "deny-rate change" ], "contain": [ "fail closed for privileged/new sessions", "bound any approved cached-read exception" ], "recover": [ "restore trusted source", "refresh keys/policies", "terminate stale sessions where required" ], "assertions": [ "no permissive fallback", "stale policy window bounded", "recovery audited" ], "evidenceRequired": [ "freshness metrics", "decision samples", "recovery timeline", "risk approval" ] }, { "id": "BREAK_GLASS_USE", "inject": "Run an approved simulated emergency operation through the isolated path.", "detect": [ "immediate Security page", "PAM session start/expiry" ], "contain": [ "15-minute scoped session", "two distinct custodians", "no policy/audit bypass" ], "recover": [ "auto-expire access", "rotate affected credentials", "next-business-day review" ], "assertions": [ "self-approval impossible", "allowlist enforced", "session cannot be extended silently" ], "evidenceRequired": [ "incident ticket", "two approvals", "session metadata", "rotation and review receipts" ] } ], "restoreTests": [ { "id": "POSTGRES_PITR", "environment": "ISOLATED_PRODUCTION_LIKE", "externalEffects": "PROHIBITED", "objectiveSource": "APPROVED_BIA_AND_SERVICE_SLO", "procedure": "Restore base backup and WAL to a sampled timestamp; keep egress and publishers disabled; fence any old writer.", "assertions": [ "pg_verifybackup/vendor verification passes", "schema compatibility and migration digests pass", "idempotency, audit heads, ledger balance, outbox heads and evidence digests reconcile", "authority_epoch changes before traffic resumes", "measured RPO/RTO meet the approved objectives" ], "evidenceRequired": [ "backup manifest", "LSN/timeline", "invariant report", "timings", "approval receipt" ], "productionStatus": "OPEN" }, { "id": "AUDIT_AND_EVIDENCE_ARCHIVE", "environment": "ISOLATED_PRODUCTION_LIKE", "externalEffects": "PROHIBITED", "objectiveSource": "APPROVED_BIA_AND_SERVICE_SLO", "procedure": "Restore selected immutable audit/evidence segments, manifests, legal-hold metadata and key-version references.", "assertions": [ "segment signatures/digests and predecessor chains verify", "tenant and retention boundaries remain intact", "missing/tampered objects fail verification", "no raw secret or unapproved payload appears in restored metadata" ], "evidenceRequired": [ "object-lock policy", "restore manifest", "verification report", "access audit" ], "productionStatus": "OPEN" }, { "id": "KMS_AND_VAULT_RECOVERY", "environment": "ISOLATED_PRODUCTION_LIKE", "externalEffects": "PROHIBITED", "objectiveSource": "APPROVED_BIA_AND_SERVICE_SLO", "procedure": "Exercise approved KMS/HSM and Vault recovery with environment-scoped canary keys/leases and two-person custody.", "assertions": [ "non-exportability and role separation remain intact", "only required canary artifacts decrypt/verify", "retired/revoked material remains denied", "recovery creates no shared root or cross-environment trust" ], "evidenceRequired": [ "custody approvals", "key/lease metadata", "positive/negative crypto transcript", "audit" ], "productionStatus": "OPEN" }, { "id": "KAFKA_REBUILD_AND_CONSUMER_RESUME", "environment": "ISOLATED_PRODUCTION_LIKE", "externalEffects": "PROHIBITED", "objectiveSource": "APPROVED_BIA_AND_SERVICE_SLO", "procedure": "Rebuild publication from committed outbox and resume consumers from durable inbox/watermarks in a blocked-egress destination.", "assertions": [ "per-key order and tenant envelope remain valid", "duplicates create no duplicate side effect", "poison events quarantine without blocking unrelated streams", "outbox, broker and inbox counts reconcile" ], "evidenceRequired": [ "offset/watermark manifest", "outbox/inbox reconciliation", "ACL proof", "timings" ], "productionStatus": "OPEN" }, { "id": "REDIS_COLD_START", "environment": "ISOLATED_PRODUCTION_LIKE", "externalEffects": "PROHIBITED", "objectiveSource": "APPROVED_BIA_AND_SERVICE_SLO", "procedure": "Start with empty cache/session/rate-limit namespaces according to their separate durability contracts.", "assertions": [ "authoritative correctness does not depend on cached values", "stale authority epoch values are rejected", "database load under 100 percent cache miss stays within the approved envelope", "security budgets fail closed where durable counters are required" ], "evidenceRequired": [ "cold-cache load report", "authority tests", "database metrics", "limit decision log" ], "productionStatus": "OPEN" }, { "id": "CONFIG_IDENTITY_AND_POLICY_RESTORE", "environment": "ISOLATED_PRODUCTION_LIKE", "externalEffects": "PROHIBITED", "objectiveSource": "APPROVED_BIA_AND_SERVICE_SLO", "procedure": "Reconstruct signed configuration, IdP/PDP clients, scopes/RBAC mappings and approved policy assignments from immutable source plus secrets by reference.", "assertions": [ "artifact digests/provenance match the approved release", "no secret is present in configuration backup", "revoked principals/clients remain revoked", "unknown or stale policy/config keeps readiness closed" ], "evidenceRequired": [ "configuration manifest", "identity/PDP export", "negative auth tests", "readiness evidence" ], "productionStatus": "OPEN" } ], "activationChecklist": [ { "id": "SOURCE_ACCEPTANCE_LEDGER_COMPLETE", "owner": "Product Security", "status": "OPEN", "evidence": "Every applicable A15–A22 report acceptance criterion maps to a control, current test/evidence reference, owner and explicit gap." }, { "id": "API_THREAT_MODEL_APPROVED", "owner": "CISO delegate", "status": "OPEN", "evidence": "Reviewed data-flow/abuse-case model covers every deployed API/version/environment and names residual risk owners." }, { "id": "A22_1_IAM_GATES_CLOSED", "owner": "Identity Platform", "status": "OPEN", "evidence": "Every certarail.production-iam-design.v1 activation gate is closed with immutable evidence." }, { "id": "A22_2_NETWORK_SECRETS_GATES_CLOSED", "owner": "Platform Security", "status": "OPEN", "evidence": "Every certarail.production-network-secrets-design.v1 activation gate is closed with immutable evidence." }, { "id": "AUTHORIZATION_MATRIX_PASSED", "owner": "Application Security", "status": "OPEN", "evidence": "Positive and negative operation-to-scope/RBAC/resource/property tests pass against the immutable production candidate." }, { "id": "TENANT_ESCAPE_MATRIX_PASSED", "owner": "Application Security", "status": "OPEN", "evidence": "Two-tenant HTTP/domain/RLS/cache/Kafka/job/export/support/restore matrix passes with a non-owner runtime role." }, { "id": "RESOURCE_ABUSE_CAPACITY_ACCEPTED", "owner": "SRE", "status": "OPEN", "evidence": "Measured byte/parser/concurrency/rate/database/export/queue/retry limits preserve fairness and approved SLOs." }, { "id": "AUDIT_PIPELINE_ACCEPTED", "owner": "Security Operations", "status": "OPEN", "evidence": "External append-only/WORM-equivalent sink, SIEM delivery/gap alerting, retention/access controls and secret-canary tests pass." }, { "id": "INCIDENT_EXERCISES_ACCEPTED", "owner": "Incident Commander", "status": "OPEN", "evidence": "Tabletop and technical exercises cover identity, tenant escape, exhaustion, provider/webhook, KMS/Vault, data, audit, supply chain and break-glass." }, { "id": "RESTORE_OBJECTIVES_ACCEPTED", "owner": "SRE", "status": "OPEN", "evidence": "Observed isolated restores satisfy approved BIA/SLO RPO/RTO and every declared invariant; backup creation alone does not close this gate." }, { "id": "OBSERVABILITY_AND_ON_CALL_READY", "owner": "SRE", "status": "OPEN", "evidence": "Control health, saturation, authorization denies, audit gaps, revocation, recovery and dependency alerts page named owners and link runbooks." }, { "id": "INDEPENDENT_REVIEW_COMPLETE", "owner": "CISO delegate", "status": "OPEN", "evidence": "Independent signed report and retest close all Critical/High findings; lower findings have explicit risk owner, decision and expiry." }, { "id": "ACTIVATION_AND_ROLLBACK_SIGNED", "owner": "System Owner + CISO delegate", "status": "OPEN", "evidence": "Immutable candidate digest, go/no-go record, staged activation, rollback criteria, kill path and post-activation verification are approved." } ], "independentReview": { "status": "NOT_PERFORMED", "reviewer": "NOT_SELECTED", "authorsMayApprove": false, "independence": "Reviewer and final approver must not be the control author, production administrator, key custodian or finding owner; conflicts are disclosed.", "scope": [ "API architecture, data flows, trust boundaries and threat model", "Human/workload IAM, scopes/RBAC/resource policy and privileged access", "Tenant isolation through HTTP, domain, PostgreSQL RLS, cache, Kafka, jobs, exports and restore", "TLS/private network/CORS/egress, KMS/HSM, Vault, rotation and revocation", "Resource-consumption, sensitive-flow abuse and provider/webhook security", "Audit/SIEM/WORM, incident response, backup/restore and supply chain" ], "methods": [ "THREAT_MODEL_AND_ARCHITECTURE_REVIEW", "SOURCE_AND_CONFIGURATION_REVIEW", "AUTHENTICATED_API_PENETRATION_TEST", "TENANT_ESCAPE_TEST", "CLOUD_IAM_NETWORK_KMS_VAULT_REVIEW", "RESOURCE_ABUSE_AND_RESILIENCE_TEST", "OBSERVED_INCIDENT_EXERCISE", "OBSERVED_RESTORE_EXERCISE", "SUPPLY_CHAIN_AND_PROVENANCE_REVIEW" ], "inputs": [ "Immutable source commit, build/image digest, SBOM and provenance", "A15–A22 source acceptance ledger and versioned machine contracts", "Production-like topology/config exports with secrets redacted by construction", "Test manifests, raw transcripts, metrics, audit manifests and drill receipts", "Data classification, BIA/SLO, retention, incident and access-review decisions" ], "rulesOfEngagement": [ "Named systems, tenants, source addresses, time window, stop conditions and incident contacts", "Synthetic/canary data and credentials; no real asset movement or provider/regulator effect", "Production-safe validation only by explicit written scope; destructive tests run in an isolated production-like environment", "Findings and evidence use approved encrypted channels and retention; secrets are never embedded in the report" ], "productionTesting": { "default": "PROHIBITED_UNLESS_EXPLICITLY_APPROVED_IN_RULES_OF_ENGAGEMENT", "destructiveTesting": "PROHIBITED", "realMoneyAssetsOrRegulatorEffects": "PROHIBITED" }, "deliverables": [ "Signed scope and independence/conflict declaration", "Finding register with stable ID, severity, affected asset/control, evidence and reproducible safe steps", "Remediation owner, due date and explicit risk acceptance authority", "Independent retest evidence and residual-risk statement", "Final activation recommendation bound to exact candidate digests" ], "cadence": [ "Before first Production activation", "At least annually after activation", "After material identity, authorization, tenant, network, cryptographic, recovery or provider-boundary change", "After a severe incident or evidence of control bypass" ], "exitCriteria": "All Critical and High findings are independently retested closed. Any remaining finding has named risk owner, signed decision, compensating controls and expiry; the final report is bound to the exact activation candidate." } }, "evidence": { "repositoryChecks": [ { "id": "HTTP_AUTHENTICATION_AND_TENANT_BINDING", "level": "REPOSITORY_TEST", "command": "go test ./internal/httpapi -run 'Test(AuthenticateRequiresOneCanonicalBearerHeader|AuthenticateRejectsUnknownMultiBuyerCredential|EvaluationRejectsTenantOutsideCredentialBinding)$'", "files": [ "internal/httpapi/handler_test.go", "internal/httpapi/tenantauth_test.go" ], "testNames": [ { "sourceFile": "internal/httpapi/handler_test.go", "name": "TestAuthenticateRequiresOneCanonicalBearerHeader" }, { "sourceFile": "internal/httpapi/tenantauth_test.go", "name": "TestAuthenticateRejectsUnknownMultiBuyerCredential" }, { "sourceFile": "internal/httpapi/handler_test.go", "name": "TestEvaluationRejectsTenantOutsideCredentialBinding" } ], "proves": "Current Local bearer grammar and server-derived tenant rejection paths only; not production OIDC/mTLS." }, { "id": "AUTHORIZATION_AND_MAKER_CHECKER", "level": "REPOSITORY_TEST", "command": "go test ./internal/httpapi -run 'Test(CorporateOnboardingDraftHTTPEnforcesRoleAndSessionBinding|SelfServiceSandboxHTTPRequiresDedicatedIssuerRole|CorporateDealScenarioRejectsApprovalEventMismatch)$'", "files": [ "internal/httpapi/corporate_onboarding_draft_test.go", "internal/httpapi/self_service_sandbox_test.go", "internal/httpapi/deal_scenarios_test.go" ], "testNames": [ { "sourceFile": "internal/httpapi/corporate_onboarding_draft_test.go", "name": "TestCorporateOnboardingDraftHTTPEnforcesRoleAndSessionBinding" }, { "sourceFile": "internal/httpapi/self_service_sandbox_test.go", "name": "TestSelfServiceSandboxHTTPRequiresDedicatedIssuerRole" }, { "sourceFile": "internal/httpapi/deal_scenarios_test.go", "name": "TestCorporateDealScenarioRejectsApprovalEventMismatch" } ], "proves": "Selected current role/session and approval boundaries; not the complete production operation-to-policy matrix." }, { "id": "HTTP_AND_DOMAIN_TENANT_ISOLATION", "level": "REPOSITORY_TEST", "command": "go test ./internal/httpapi -run 'Test(ExtendedRoutesRejectTenantOutsideCredentialBinding|CorporateBoundaryScopesReadsAndMutationsToAuthenticatedOrganization|AssetLinkCreateRejectsClientSelectedSubjectAndCrossTenant)$'", "files": [ "internal/httpapi/extensions_test.go", "internal/httpapi/corporate_test.go", "internal/httpapi/assetlink_test.go" ], "testNames": [ { "sourceFile": "internal/httpapi/extensions_test.go", "name": "TestExtendedRoutesRejectTenantOutsideCredentialBinding" }, { "sourceFile": "internal/httpapi/corporate_test.go", "name": "TestCorporateBoundaryScopesReadsAndMutationsToAuthenticatedOrganization" }, { "sourceFile": "internal/httpapi/assetlink_test.go", "name": "TestAssetLinkCreateRejectsClientSelectedSubjectAndCrossTenant" } ], "proves": "Selected public transport/domain isolation paths in the current repository." }, { "id": "POSTGRES_RLS_AND_DURABLE_ISOLATION", "level": "REPOSITORY_INTEGRATION_TEST", "command": "go test ./internal/persistence/postgresstore -run 'Test(DeveloperEvidenceDurableReplayRLSAndAppendOnlyPack|CorporateTreasuryIntegrationLifecycleReplayAndIsolation|WebhookSubscriptionDurableRestartRLSRetryAndConcurrentVerification)$'", "files": [ "internal/persistence/postgresstore/developer_evidence_integration_test.go", "internal/persistence/postgresstore/corporate_integration_test.go", "internal/persistence/postgresstore/checkout_webhook_subscription_integration_test.go" ], "testNames": [ { "sourceFile": "internal/persistence/postgresstore/developer_evidence_integration_test.go", "name": "TestDeveloperEvidenceDurableReplayRLSAndAppendOnlyPack" }, { "sourceFile": "internal/persistence/postgresstore/corporate_integration_test.go", "name": "TestCorporateTreasuryIntegrationLifecycleReplayAndIsolation" }, { "sourceFile": "internal/persistence/postgresstore/checkout_webhook_subscription_integration_test.go", "name": "TestWebhookSubscriptionDurableRestartRLSRetryAndConcurrentVerification" } ], "proves": "Selected PostgreSQL RLS/durable tenant paths when the integration database is available; not full production role inventory." }, { "id": "RESOURCE_ADMISSION_BACKPRESSURE_AND_DEADLINES", "level": "REPOSITORY_TEST", "command": "go test ./internal/httpapi -run 'Test(EvaluationRejectsOverloadWithoutQueueing|EvaluationDeadlineCancelsProcessor|ReadRoutesApplyControlBackpressureAndDeadline|TradingAdmissionPrecedesRequestBodyRead)$'", "files": [ "internal/httpapi/handler_test.go", "internal/httpapi/extensions_test.go", "internal/httpapi/trading_test.go" ], "testNames": [ { "sourceFile": "internal/httpapi/handler_test.go", "name": "TestEvaluationRejectsOverloadWithoutQueueing" }, { "sourceFile": "internal/httpapi/handler_test.go", "name": "TestEvaluationDeadlineCancelsProcessor" }, { "sourceFile": "internal/httpapi/extensions_test.go", "name": "TestReadRoutesApplyControlBackpressureAndDeadline" }, { "sourceFile": "internal/httpapi/trading_test.go", "name": "TestTradingAdmissionPrecedesRequestBodyRead" } ], "proves": "Application admission and deadlines for selected paths; not edge, distributed limiter or measured production capacity." }, { "id": "AUDIT_CHAIN_TAMPER_AND_FAILURE", "level": "REPOSITORY_TEST", "command": "go test ./internal/audit ./internal/httpapi -run 'Test(FileLogDetectsTampering|FileLogRejectsUnversionedDecision|EvaluationFailsClosedWhenAuditIsUnavailable)$'", "files": [ "internal/audit/filelog_test.go", "internal/httpapi/handler_test.go" ], "testNames": [ { "sourceFile": "internal/audit/filelog_test.go", "name": "TestFileLogDetectsTampering" }, { "sourceFile": "internal/audit/filelog_test.go", "name": "TestFileLogRejectsUnversionedDecision" }, { "sourceFile": "internal/httpapi/handler_test.go", "name": "TestEvaluationFailsClosedWhenAuditIsUnavailable" } ], "proves": "Local audit chaining and a selected fail-closed mutation; not external WORM/SIEM delivery or production retention." }, { "id": "WEBHOOK_SIGNATURE_REPLAY_AND_RETRY", "level": "REPOSITORY_TEST", "command": "go test ./internal/checkout -run 'Test(WebhookTamperAndReplayWindow|WebhookTestEventSignatureScenarios|WebhookRetryQuarantinesAtAttemptBudget)$'", "files": [ "internal/checkout/service_test.go", "internal/checkout/webhook_test_event_scenarios_test.go", "internal/checkout/webhook_retry_test.go" ], "testNames": [ { "sourceFile": "internal/checkout/service_test.go", "name": "TestWebhookTamperAndReplayWindow" }, { "sourceFile": "internal/checkout/webhook_test_event_scenarios_test.go", "name": "TestWebhookTestEventSignatureScenarios" }, { "sourceFile": "internal/checkout/webhook_retry_test.go", "name": "TestWebhookRetryQuarantinesAtAttemptBudget" } ], "proves": "Sandbox signature/replay and retry state machines; not production endpoint egress, KMS key or worker SLO." }, { "id": "SCHEMA_AND_RECOVERY_GUARDS", "level": "REPOSITORY_TEST", "command": "go test ./internal/persistence/postgresstore -run 'Test(StoreControlScriptsFailThroughSQLRatherThanIgnoredQuitCodes|AssessSchemaCompatibilityRejectsUnverifiedContracts|StoreCheckSchemaCompatibilityFailsClosedWithoutOpenStore)$'", "files": [ "internal/persistence/postgresstore/store_test.go", "internal/persistence/postgresstore/schema_compatibility_test.go" ], "testNames": [ { "sourceFile": "internal/persistence/postgresstore/store_test.go", "name": "TestPostgresControlScriptsFailThroughSQLRatherThanIgnoredQuitCodes" }, { "sourceFile": "internal/persistence/postgresstore/schema_compatibility_test.go", "name": "TestAssessSchemaCompatibilityRejectsUnverifiedContracts" }, { "sourceFile": "internal/persistence/postgresstore/schema_compatibility_test.go", "name": "TestStoreCheckSchemaCompatibilityFailsClosedWithoutOpenStore" } ], "proves": "Control-script and schema-admission guards only; no backup, PITR, KMS/Vault or full restore exercise." }, { "id": "A15_A22_PUBLISHED_CONTRACTS", "level": "REPOSITORY_TEST", "command": "node --test tests/openapi-collections.test.mjs tests/asyncapi-event-catalog.test.mjs tests/production-kafka-design.test.mjs tests/self-service-sandbox.test.mjs tests/developer-console-routes.test.mjs tests/webhook-reference.test.mjs tests/production-iam-design.test.mjs tests/production-network-secrets-design.test.mjs tests/production-security-controls.test.mjs", "files": [ "website/tests/openapi-collections.test.mjs", "website/tests/asyncapi-event-catalog.test.mjs", "website/tests/production-kafka-design.test.mjs", "website/tests/self-service-sandbox.test.mjs", "website/tests/developer-console-routes.test.mjs", "website/tests/webhook-reference.test.mjs", "website/tests/production-iam-design.test.mjs", "website/tests/production-network-secrets-design.test.mjs", "website/tests/production-security-controls.test.mjs" ], "testNames": [ { "sourceFile": "website/tests/openapi-collections.test.mjs", "name": "A15.3/A18.1 publishes the changelog and all collection downloads" }, { "sourceFile": "website/tests/asyncapi-event-catalog.test.mjs", "name": "A16.1 derives one complete catalog entry" }, { "sourceFile": "website/tests/production-kafka-design.test.mjs", "name": "A16.3 fixes ten substantive production Kafka design decisions" }, { "sourceFile": "website/tests/self-service-sandbox.test.mjs", "name": "A19.1-A19.2 relay validates the atomic receipt" }, { "sourceFile": "website/tests/developer-console-routes.test.mjs", "name": "A20.2 server-renders one active Developer Console workspace per route" }, { "sourceFile": "website/tests/webhook-reference.test.mjs", "name": "A21.3 publishes three SDK verification examples" }, { "sourceFile": "website/tests/production-iam-design.test.mjs", "name": "A22.1 fixes the identity authorities" }, { "sourceFile": "website/tests/production-network-secrets-design.test.mjs", "name": "A22.2 fixes TLS, private-network and CORS" }, { "sourceFile": "website/tests/production-security-controls.test.mjs", "name": "A22.3 maps the complete OWASP API threat model" } ], "proves": "Repository acceptance lineage and deterministic publication only; it does not close production-like or independent evidence gates." } ], "productionEvidence": [ { "id": "PRODUCTION_LIKE_AUTHORIZATION_AND_TENANT_MATRIX", "status": "OPEN", "required": "Immutable-candidate execution with production IdP/PDP, non-owner RLS role, cache, Kafka, workers, exports and support access." }, { "id": "MEASURED_RESOURCE_ABUSE_AND_CAPACITY", "status": "OPEN", "required": "Signed load profile, limits, fairness/SLO results, cost budgets, edge and dependency saturation evidence." }, { "id": "EXTERNAL_AUDIT_SINK_AND_INCIDENT_DRILLS", "status": "OPEN", "required": "WORM-equivalent/SIEM manifests, secret canaries, gap alerts and completed technical incident exercises." }, { "id": "OBSERVED_RESTORE_AND_FAILOVER", "status": "OPEN", "required": "Isolated production-like restore/failover evidence meeting approved BIA/SLO objectives and invariants." }, { "id": "INDEPENDENT_REVIEW_AND_RETEST", "status": "OPEN", "required": "Independent signed scope, findings, remediation/retest and residual-risk recommendation bound to candidate digests." } ], "passRecordRequiredFields": [ "check_or_gate_id", "started_at", "completed_at", "source_commit", "build_or_image_digest", "configuration_digest", "environment_id", "toolchain_versions", "result", "artifact_digests", "operator_or_automation_identity", "reviewer_identity", "expiry_or_retest_due_at" ] }, "references": [ { "label": "OWASP API Security Top 10 · 2023", "href": "https://owasp.org/API-Security/editions/2023/en/0x00-toc/" }, { "label": "OWASP API4:2023 · Unrestricted Resource Consumption", "href": "https://owasp.org/API-Security/editions/2023/en/0xa4-unrestricted-resource-consumption/" }, { "label": "NIST SP 800-53 Rev. 5 · Security and Privacy Controls", "href": "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final" }, { "label": "NIST SP 800-53A Rev. 5 · Assessing Security and Privacy Controls", "href": "https://csrc.nist.gov/pubs/sp/800/53/a/r5/final" }, { "label": "NIST SP 800-61 Rev. 3 · Incident Response", "href": "https://csrc.nist.gov/pubs/sp/800/61/r3/final" }, { "label": "NIST SP 800-34 Rev. 1 · Contingency Planning", "href": "https://csrc.nist.gov/pubs/sp/800/34/r1/upd1/final" }, { "label": "NIST SP 800-92 · Log Management", "href": "https://csrc.nist.gov/pubs/sp/800/92/final" }, { "label": "NIST SP 800-115 · Technical Guide to Security Testing", "href": "https://csrc.nist.gov/pubs/sp/800/115/final" } ], "sections": [ { "id": "security-controls-current-boundary", "title": "Текущая граница доказательств", "lead": "A22.3 публикует testable control contract и точные repository evidence locators. Он не превращает Local/sandbox tests, generated JSON или checklist в Production acceptance, restore drill либо independent review.", "table": { "caption": "Evidence levels and current meaning", "columns": [ "Level", "Что можно утверждать", "Что остаётся OPEN" ], "rows": [ [ "Repository test", "Named source path and test function exercise a current Local/sandbox control.", "Production IdP/network/KMS/Vault/topology/capacity." ], [ "Repository integration test", "Named PostgreSQL test can exercise durable/RLS behavior when its test database is available.", "Production role inventory, HA, backup, restore and operational ownership." ], [ "Production-like evidence", "Exact immutable candidate is exercised in the approved isolated topology.", "Independent assessment and signed activation until separately completed." ], [ "Independent evidence", "Qualified non-author reviewer retests controls and findings against exact candidate digests.", "Only the named activation authority can approve Production use." ] ] }, "callout": { "tone": "critical", "title": "Production activation остаётся закрытой", "description": "Все A22.3 activation/evidence gates OPEN; independent review NOT_PERFORMED. Этот artifact задаёт проверяемый план и контрольную поверхность, но не является certification, penetration-test report или go-live approval." } }, { "id": "api-threat-model", "title": "API threat model", "lead": "OWASP_API_SECURITY_TOP_10_2023_PLUS_CERTARAIL_ABUSE_CASES. Scope: Every public, partner, internal, administration, webhook, worker, export and recovery API in all canonical environments.", "bullets": [ "Assets: Tenant identity, organization binding, scopes, roles and approval state; Authoritative policy, decision, idempotency, ledger, movement and provider state; Credentials, signing/encryption key references and revocation state; Audit, evidence, outbox/inbox, webhook and recovery artifacts; Availability, per-tenant fairness and production activation authority.", "Trust boundaries: Browser or partner client to approved edge/BFF/API gateway; Gateway to control-plane API and authorization decision point; Application runtime to PostgreSQL, cache, Kafka, Temporal and object storage; Webhook/provider ingress and controlled outbound delivery/adapter egress; Human administration to private JIT management and break-glass planes; Production to backup, DR, restore and independent-review environments.", "Adversaries: Unauthenticated internet client; Authenticated user or workload exceeding its tenant/resource authority; Compromised tenant administrator, support principal or service credential; Malicious or compromised provider/webhook endpoint; Insider with partial database, log, KMS, Vault or deployment access; Automated abuse causing cost, queue, parser, connection or storage exhaustion.", "Every reachable operation must inherit at least one risk row, control owner and positive/negative test before activation." ], "table": { "caption": "OWASP API 2023 risk-to-control/test traceability", "columns": [ "Risk", "CertaRail abuse case", "Controls", "Test cases" ], "rows": [ [ "API1:2023 · Broken Object Level Authorization", "A valid principal substitutes another tenant resource ID or causes a background/export job to load it.", "AUTHZ-001, TENANT-001, AUDIT-001", "AUTHZ-POSITIVE-OWN-OBJECT, AUTHZ-NEGATIVE-CROSS-OBJECT, AUTHZ-NEGATIVE-TENANT-CONFLICT" ], [ "API2:2023 · Broken Authentication", "An attacker reuses expired, revoked, wrong-audience or confused principal-type credentials.", "AUTHN-001, AUDIT-001", "AUTHN-NEGATIVE-MISSING, AUTHN-NEGATIVE-INVALID, AUTHZ-NEGATIVE-REVOKED, AUTHZ-NEGATIVE-IDENTITY-CONFUSION" ], [ "API3:2023 · Broken Object Property Level Authorization", "A caller over-posts tenant/owner/status/approval fields or receives properties outside its relationship.", "AUTHZ-002, CONFIG-001", "AUTHZ-NEGATIVE-PROPERTY" ], [ "API4:2023 · Unrestricted Resource Consumption", "A client exhausts bytes, parsing, concurrency, database, export, queue, retry or paid-provider budgets.", "RESOURCE-001, AUDIT-001", "RESOURCE-BODY-LIMIT, RESOURCE-CONCURRENCY-LIMIT, RESOURCE-DEADLINE, RESOURCE-PAGE-EXPORT-LIMIT, RESOURCE-TENANT-COST-BUDGET, RESOURCE-DATABASE-BUDGET, RESOURCE-RETRY-AMPLIFICATION" ], [ "API5:2023 · Broken Function Level Authorization", "A lower-privilege principal calls an administrative function or self-approves a privileged action.", "AUTHZ-002, AUDIT-001", "AUTHZ-NEGATIVE-SCOPE, AUTHZ-NEGATIVE-SELF-APPROVAL" ], [ "API6:2023 · Unrestricted Access to Sensitive Business Flows", "Automation races or repeats a state-changing flow, bypasses ordering or consumes an unbounded business resource.", "FLOW-001, RESOURCE-001, AUDIT-001", "FLOW-REPLAY-CONFLICT, RESOURCE-TENANT-COST-BUDGET" ], [ "API7:2023 · Server Side Request Forgery", "A configured URL reaches a private, link-local or redirected destination outside the approved provider profile.", "SSRF-001, CONFIG-001", "SSRF-DESTINATION-ESCAPE" ], [ "API8:2023 · Security Misconfiguration", "A missing setting activates debug routes, permissive origins, plaintext transport, verbose errors or excess privileges.", "CONFIG-001, INVENTORY-001, AUDIT-001", "CONFIG-FAIL-CLOSED, INVENTORY-ROUTE-DRIFT" ], [ "API9:2023 · Improper Inventory Management", "A stale, shadow, undocumented or lower-environment endpoint remains reachable without current controls.", "INVENTORY-001, CONFIG-001", "INVENTORY-ROUTE-DRIFT" ], [ "API10:2023 · Unsafe Consumption of APIs", "Authenticated third-party data is trusted without schema, size, semantic, deadline, replay or provenance validation.", "DEPENDENCY-001, RESOURCE-001, AUDIT-001", "DEPENDENCY-UNTRUSTED-RESPONSE, RESOURCE-DEADLINE, RESOURCE-RETRY-AMPLIFICATION" ] ] } }, { "id": "authorization-test-plan", "title": "Authorization tests", "lead": "Tests follow the public seam: identity validation, route/function policy, object/relationship predicate and response filtering. A mocked permit decision without the protected handler/resource assertion is insufficient.", "table": { "caption": "Positive and negative authorization cases", "columns": [ "ID", "Stimulus", "Expected", "Assertion", "Evidence level" ], "rows": [ [ "AUTHZ-POSITIVE-OWN-OBJECT", "Authorized principal uses the declared scope on its own tenant object.", "200", "The exact allowed projection is returned and the permit decision is audited.", "PRODUCTION_LIKE" ], [ "AUTHN-NEGATIVE-MISSING", "Omit the required credential.", "401", "Fail before handler execution and emit no protected metadata.", "REPOSITORY_AND_PRODUCTION_LIKE" ], [ "AUTHN-NEGATIVE-INVALID", "Use malformed, expired, wrong-issuer, wrong-audience or invalid-signature material.", "401", "Every credential class fails closed with a bounded public error and reason-coded audit record.", "PRODUCTION_LIKE" ], [ "AUTHZ-NEGATIVE-SCOPE", "Use a valid identity without the required operation scope or role.", "403", "No domain method or downstream dependency is invoked.", "REPOSITORY_AND_PRODUCTION_LIKE" ], [ "AUTHZ-NEGATIVE-CROSS-OBJECT", "Tenant A requests a valid resource identifier that belongs to tenant B.", "404", "Deny before side effects and preserve the endpoint existence-hiding policy.", "REPOSITORY_AND_PRODUCTION_LIKE" ], [ "AUTHZ-NEGATIVE-PROPERTY", "Add tenant, owner, role, status, approval or internal routing fields to a request.", "400", "Reject unknown/protected properties; response filtering never discloses unauthorized fields.", "REPOSITORY_AND_PRODUCTION_LIKE" ], [ "AUTHZ-NEGATIVE-SELF-APPROVAL", "The maker attempts to approve its own privileged operation.", "403", "Approval requires two distinct principals and cannot be satisfied by role aliasing or session replacement.", "REPOSITORY_AND_PRODUCTION_LIKE" ], [ "AUTHZ-NEGATIVE-IDENTITY-CONFUSION", "A workload credential calls a human-only route or a human session calls a workload-only operation.", "403", "Principal type, client/workload identity and authentication context remain authorization inputs.", "PRODUCTION_LIKE" ], [ "AUTHZ-NEGATIVE-TENANT-CONFLICT", "A valid identity supplies a conflicting tenant in path, query, body or forwarding header.", "403", "The trusted server binding wins; the conflicting assertion is rejected and never becomes scope.", "REPOSITORY_AND_PRODUCTION_LIKE" ], [ "AUTHZ-NEGATIVE-REVOKED", "Reuse a revoked session, token family, client or workload certificate.", "401", "Use is denied within the A22.1/A22.2 propagation SLA and linked to revocation evidence.", "PRODUCTION_LIKE" ] ] }, "bullets": [ "Generate the matrix from canonical operation security plus A22.1 scope/RBAC/resource policies; fail if a reachable protected operation has no positive and negative case.", "Assert the downstream/domain spy count is zero on deny and compare durable state/effects before and after each negative case.", "Use missing, malformed, expired, revoked, wrong-issuer/audience, wrong principal type, missing scope, wrong tenant/object and protected-property variants.", "Authorization evidence records exact candidate digest, IdP/PDP/policy versions, test fixture IDs, result and audit-event digest without credentials." ] }, { "id": "tenant-isolation-test-plan", "title": "Tenant isolation tests", "lead": "Create tenant A and tenant B with distinct organizations, principals, resources, idempotency keys, cache entries, topic identities, jobs, audit records and backup samples.", "table": { "caption": "Two-tenant isolation matrix", "columns": [ "Layer", "Positive assertion", "Negative assertion", "Evidence" ], "rows": [ [ "HTTP_TRANSPORT", "Tenant A can use its own path/query/body/header combination only where the contract allows it.", "Every caller-selected conflicting tenant/organization/subject value is rejected before service invocation.", "HTTP transcript; service-spy assertion; audit decision" ], [ "DOMAIN_SERVICE", "Trusted scope is passed explicitly into repositories and dependent services.", "A mismatched aggregate, relationship, approval or replay owner cannot transition state.", "focused domain test; state diff; side-effect count" ], [ "POSTGRES_RLS", "A non-owner runtime role reads/writes rows only with matching SET LOCAL tenant context.", "Missing context, tenant B access, WITH CHECK violation and attempted RLS bypass all fail.", "role grants; FORCE RLS inventory; live two-tenant SQL transcript" ], [ "CACHE", "Cache namespace and signed envelope bind environment, tenant, resource, policy version and authority epoch.", "Tenant B, stale epoch, wrong key ID and moved raw key/value cannot produce authority or a cache hit.", "key-shape test; envelope verification; cold-cache result" ], [ "KAFKA", "Producer/consumer identity, topic ACL, partition key and envelope carry the same tenant/environment binding.", "Cross-tenant topic access, envelope mismatch and unauthorized replay are denied or quarantined.", "broker ACL export; negative publish/consume transcript; quarantine evidence" ], [ "BACKGROUND_WORK", "Outbox, workflow, retry, scan and export jobs rehydrate signed tenant scope from durable state.", "A queue payload alone cannot select tenant/resource or redirect an effect.", "job envelope; restart test; cross-tenant poison-message test" ], [ "AUDIT_AND_EXPORT", "Audit/search/export requires tenant-aware authorization and records exact selection criteria.", "Batch, pagination, alias/correlation lookup and downloadable evidence never cross tenant boundaries.", "export manifest; negative lookup tests; audit access event" ], [ "PRIVILEGED_SUPPORT", "JIT support access names one tenant, reason, ticket, command allowlist and expiry.", "Standing, global, self-approved or expired support access is denied.", "PAM grant; two-person approval; session recording metadata; post-review" ], [ "BACKUP_AND_RESTORE", "Restore preserves tenant keys/policies and validation can sample each tenant independently.", "Restore tooling cannot copy production tenant data/secrets into a lower environment or expose a cross-tenant export.", "restore manifest; environment attestations; two-tenant verification" ] ] }, "bullets": [ "PostgreSQL runtime role owns tables: false; BYPASSRLS: false; FORCE RLS required: true.", "SET LOCAL certarail.tenant_id inside every transaction; missing or malformed context fails closed.", "Repeat the matrix for list, detail, create, mutate, delete/revoke, batch, search, export, retry/replay and recovery paths; success on one route cannot stand in for another.", "A 404 existence-hiding response must still prove zero tenant-B read/effect in service/database/audit evidence." ] }, { "id": "resource-consumption-controls", "title": "Resource-consumption controls", "lead": "Limits are versioned policy with owner, measured source, metric, overload outcome and test. Edge, application and dependency budgets must compose; a high outer limit cannot silently bypass a lower inner guarantee.", "table": { "caption": "Measurable resource controls and current repository boundary", "columns": [ "Control", "Metric", "Current repository fact", "Limit source", "Overload outcome" ], "rows": [ [ "REQUEST_BODY_BYTES", "HTTP request bytes and parse allocations", "Generic JSON 1 MiB; checkout JSON 64 KiB; strict single-object decoder with unknown fields rejected.", "Versioned operation contract; edge limit must be equal to or stricter than the application limit.", "Reject before service execution with a bounded 4xx response and no body echo." ], [ "UPLOAD_BYTES", "Upload bytes, media type, scan bytes and storage reservation", "Signed fixed Content-Length, allowlisted media type and 10 MiB maximum in the Local document workflow.", "Approved document class policy plus capacity and malware-scanner envelope.", "Reject before persistence; partial bytes never become an accepted document." ], [ "REQUEST_CONCURRENCY", "In-flight requests and service operations by route class and tenant", "Bounded eligibility and control-plane semaphores; saturation returns 429 with Retry-After.", "Measured capacity test and per-tenant fairness policy.", "Immediate 429; no unbounded queue or goroutine allocation." ], [ "OPERATION_DEADLINE", "End-to-end and downstream operation duration", "Eligibility defaults to 2 seconds; control-plane operations default to 10 seconds and propagate cancellation.", "Operation SLO with a smaller downstream budget and explicit retry/idempotency semantics.", "Cancel work, preserve ambiguous-outcome recovery and return a retry-safe bounded error." ], [ "PAGINATION_AND_EXPORT", "Rows scanned, rows returned, encoded bytes and export duration", "Selected current endpoints cap arrays/pages; no repository-wide production export budget is proven.", "Per-operation OpenAPI limit plus approved asynchronous export profile.", "Reject over-limit synchronous export; use authorized bounded async artifact creation where designed." ], [ "TENANT_RATE_AND_COST_BUDGET", "Requests, sensitive actions, provider calls and cost units per tenant/credential/principal", "Hosted sandbox credential has fixed request/reset budgets; this is not a production distributed limiter.", "Approved product entitlement and abuse-risk policy.", "429 with durable reason and reset metadata; protected control capacity remains available." ], [ "DATABASE_BUDGET", "Pool wait, active connections, statement time, lock time, rows and temporary bytes", "Write admission and bounded SQL shapes exist; production pool/statement/lock budgets require measured configuration.", "PostgreSQL HA/DR connection budget and per-workload capacity plan.", "Backpressure before commit; reserved migrator, monitoring and emergency capacity is not consumed." ], [ "OUTBOX_AND_WEBHOOK_BUDGET", "Backlog bytes/age, leases, attempts, retry horizon and per-destination concurrency", "Bounded backoff, deadlines, attempt caps, quarantine and write admission are covered by repository tests.", "Destination SLO, broker capacity and durable storage high-water policy.", "Stop new affected writes where durability is at risk; quarantine terminal work without deleting evidence." ], [ "DECOMPRESSION_AND_PARSER_BUDGET", "Expanded bytes, nesting, tokens, fields and parser CPU", "Strict JSON and bounded payloads exist; no universal compressed-input policy is proven.", "Media-type-specific parser profile with compressed input disabled unless explicitly required.", "Reject unsupported encoding, excessive expansion/depth/fields or parser deadline before durable work." ] ] }, "bullets": [ "Run boundary and limit-plus-one tests, then slowloris/concurrency/storm and sustained soak tests against the exact candidate.", "Measure per-tenant fairness, memory/CPU/goroutines, connection pools, statement/lock time, queue age/bytes, retry amplification and provider cost units.", "Production limits require capacity evidence and rollback/override ownership; Local defaults are implementation facts, not Production sizing." ] }, { "id": "audit-log-requirements", "title": "Audit log requirements", "lead": "Schema certarail.security-audit-event.v1; production sink EXTERNAL_APPEND_ONLY_WORM_OR_EQUIVALENT; legally material command on audit failure: FAIL_CLOSED.", "table": { "caption": "Audit schema and handling", "columns": [ "Class", "Requirements" ], "rows": [ [ "Required fields", "event_id, schema_version, occurred_at, recorded_at, tenant_id, environment, actor_id, actor_type, issuer, client_or_workload_id, authentication_context, action, resource_type, resource_id_digest, decision, reason_code, policy_version, request_id, trace_id, idempotency_key_digest, evidence_digest, previous_event_digest, event_digest" ], [ "Conditional fields", "organization_id, subject_ref_digest, maker_actor_id, checker_actor_id, change_or_incident_ticket, source_network_zone, credential_id_digest, before_digest, after_digest" ], [ "Forbidden fields", "bearer_token, cookie, private_key, secret_value, raw_document, request_body, url_query, plaintext_personal_data, recoverable_credential" ], [ "Integrity", "Canonical event digest plus predecessor/segment manifest; signed immutable export with sequence/gap verification and separately administered time source." ], [ "Access", "Dedicated least-privilege writer, security reader and independent auditor; application administrators cannot alter retention or historical events." ], [ "SIEM", "Metadata-only routed events with rule/version ownership, delivery acknowledgement, lag/gap alerting and dead-letter recovery." ], [ "Retention", "Approved per event/data class with residency, legal hold and cryptographic-erasure dependencies; not fixed by this repository contract." ] ] }, "bullets": [ "Authentication success/failure and credential lifecycle", "Authorization permit/deny including policy/reason and protected operation", "Privileged request, approval, execution, expiry and break-glass review", "Tenant/security configuration and production activation changes", "Secret/key create, use metadata, rotate, revoke, disable and recovery", "Evidence/export access, deletion request, legal hold and retention action", "Rate/quota/backpressure decisions and security-control degradation", "Backup, restore, failover, incident and independent-review evidence changes" ], "callout": { "tone": "warning", "title": "Hash chain не равна WORM/SIEM acceptance", "description": "Repository file/PostgreSQL digest tests demonstrate selected integrity behavior only. Production requires a separately administered immutable sink, delivery/gap monitoring, access/retention evidence and restore verification." } }, { "id": "security-incident-scenarios", "title": "Incident scenarios", "lead": "Each scenario has an inject/detect/contain/recover sequence, executable assertions and immutable evidence. Tabletop validates decisions and ownership; a technical exercise validates the actual control path. Activation requires both where applicable.", "table": { "caption": "Security incident exercise catalog", "columns": [ "Scenario", "Safe injection", "Detect", "Contain / recover", "Assertions" ], "rows": [ [ "COMPROMISED_HUMAN_SESSION", "Use a canary human session after refresh-family revoke.", "revoked-use signal; impossible/risky session correlation", "terminate session family; remove JIT grants; block affected principal / reauthenticate strongly; review protected actions; rotate affected credentials", "revocation SLA met; no new protected action; complete timeline" ], [ "COMPROMISED_SERVICE_IDENTITY", "Use an old workload certificate/client after emergency revoke.", "certificate/client anomaly; revoked-use attempt", "revoke identity; deny workload policy; isolate workload/network path / issue new bound identity; redeploy clean artifact; reconcile commands", "old identity denied; new identity least-privileged; ambiguous effects reconciled" ], [ "CROSS_TENANT_ACCESS", "Attempt API, RLS, cache, Kafka, worker and export access from tenant A to tenant B.", "deny and anomaly signals; RLS/policy violations", "block principal/client; freeze affected export/workers; preserve evidence / verify all isolation layers; notify per approved plan; retest fixed path", "zero unauthorized disclosure/effect; scope of exposure determined; negative retest passes" ], [ "RESOURCE_EXHAUSTION", "Generate bounded body, concurrency, page, database, queue and retry pressure.", "saturation and fairness SLO alerts; cost/quota anomaly", "tenant/credential throttle; load shedding; destination circuit/open admission gate / drain bounded backlog; reconcile dropped/retried work; restore normal limits under approval", "other tenants remain within SLO; no unbounded growth; idempotency preserved" ], [ "WEBHOOK_OR_SSRF_COMPROMISE", "Use invalid/rotated signatures and an endpoint resolving outside its approved profile.", "signature failure; destination-policy denial; delivery anomaly", "pause endpoint; revoke key; deny egress profile / verify endpoint again; rotate key; replay only exact approved events", "no disallowed connection; old key denied; replay is exact and audited" ], [ "KMS_OR_VAULT_OUTAGE_COMPROMISE", "Deny KMS/Vault access or disable an environment key/secret lease.", "lease/crypto failure; decrypt/sign error budget alert", "fail closed; isolate affected identity/key; invoke two-person recovery / restore approved service; rotate exposed material; verify old/new negative use", "no plaintext fallback; no cross-environment key use; custody separation preserved" ], [ "POSTGRES_FAILOVER_OR_CORRUPTION", "Fence a primary or restore to a selected pre-corruption point.", "quorum/lag/archive/invariant alert; authority epoch change", "close writes; fence old primary; block external publication / promote or PITR; rebuild cache; reconcile audit/ledger/idempotency/outbox", "one writer; measured RPO/RTO; all invariants pass" ], [ "KAFKA_BACKLOG_OR_POISON_EVENT", "Publish a schema-invalid/tenant-mismatched canary and stop consumer progress.", "schema/ACL rejection; lag and oldest-age alert; poison retry signal", "quarantine event; pause affected partition/consumer; preserve outbox truth / fix consumer/config; resume from durable watermark; reconcile outbox/inbox", "ordering preserved; no duplicate side effect; unaffected partitions continue" ], [ "AUDIT_GAP_OR_TAMPER", "Remove, reorder or mutate a canary event and delay sink delivery.", "digest/sequence/gap failure; sink lag alert", "freeze affected privileged actions; preserve source segments; restrict log access / re-export immutable segment; reconcile source-of-truth events; document any irrecoverable gap", "tamper is detectable; gap is not silently accepted; secrets remain absent" ], [ "SUPPLY_CHAIN_OR_CONFIG_TAMPER", "Attempt to deploy an unsigned/unknown digest or drifted security configuration.", "provenance/policy failure; runtime config drift alert", "block rollout; revoke artifact/identity; isolate affected workload / redeploy approved digest; rotate exposed credentials; reconcile runtime state", "unknown artifact never receives traffic; rollback is controlled; new digest attested" ], [ "IDP_OR_PDP_OUTAGE", "Make the production IdP/JWKS or authorization decision point unavailable/stale.", "freshness/fetch/PDP availability alert; deny-rate change", "fail closed for privileged/new sessions; bound any approved cached-read exception / restore trusted source; refresh keys/policies; terminate stale sessions where required", "no permissive fallback; stale policy window bounded; recovery audited" ], [ "BREAK_GLASS_USE", "Run an approved simulated emergency operation through the isolated path.", "immediate Security page; PAM session start/expiry", "15-minute scoped session; two distinct custodians; no policy/audit bypass / auto-expire access; rotate affected credentials; next-business-day review", "self-approval impossible; allowlist enforced; session cannot be extended silently" ] ] }, "bullets": [ "Record commander, observers, start/end, candidate digest, canary IDs, decision log, control timings, gaps, follow-up owners and retest links.", "No scenario authorizes real money/asset movement, provider/regulator effects, destructive Production testing or unapproved secret exposure.", "A detection-only exercise does not close containment/recovery assertions; a tabletop does not replace the named technical drill." ] }, { "id": "security-restore-tests", "title": "Restore tests", "lead": "Backup is accepted only after an observed restore into an isolated production-like environment, verification of declared invariants and measured comparison to an approved BIA/service SLO.", "table": { "caption": "Isolated recovery exercises", "columns": [ "Restore", "Procedure", "Assertions", "Required evidence", "Status" ], "rows": [ [ "POSTGRES_PITR", "Restore base backup and WAL to a sampled timestamp; keep egress and publishers disabled; fence any old writer.", "pg_verifybackup/vendor verification passes; schema compatibility and migration digests pass; idempotency, audit heads, ledger balance, outbox heads and evidence digests reconcile; authority_epoch changes before traffic resumes; measured RPO/RTO meet the approved objectives", "backup manifest; LSN/timeline; invariant report; timings; approval receipt", "OPEN" ], [ "AUDIT_AND_EVIDENCE_ARCHIVE", "Restore selected immutable audit/evidence segments, manifests, legal-hold metadata and key-version references.", "segment signatures/digests and predecessor chains verify; tenant and retention boundaries remain intact; missing/tampered objects fail verification; no raw secret or unapproved payload appears in restored metadata", "object-lock policy; restore manifest; verification report; access audit", "OPEN" ], [ "KMS_AND_VAULT_RECOVERY", "Exercise approved KMS/HSM and Vault recovery with environment-scoped canary keys/leases and two-person custody.", "non-exportability and role separation remain intact; only required canary artifacts decrypt/verify; retired/revoked material remains denied; recovery creates no shared root or cross-environment trust", "custody approvals; key/lease metadata; positive/negative crypto transcript; audit", "OPEN" ], [ "KAFKA_REBUILD_AND_CONSUMER_RESUME", "Rebuild publication from committed outbox and resume consumers from durable inbox/watermarks in a blocked-egress destination.", "per-key order and tenant envelope remain valid; duplicates create no duplicate side effect; poison events quarantine without blocking unrelated streams; outbox, broker and inbox counts reconcile", "offset/watermark manifest; outbox/inbox reconciliation; ACL proof; timings", "OPEN" ], [ "REDIS_COLD_START", "Start with empty cache/session/rate-limit namespaces according to their separate durability contracts.", "authoritative correctness does not depend on cached values; stale authority epoch values are rejected; database load under 100 percent cache miss stays within the approved envelope; security budgets fail closed where durable counters are required", "cold-cache load report; authority tests; database metrics; limit decision log", "OPEN" ], [ "CONFIG_IDENTITY_AND_POLICY_RESTORE", "Reconstruct signed configuration, IdP/PDP clients, scopes/RBAC mappings and approved policy assignments from immutable source plus secrets by reference.", "artifact digests/provenance match the approved release; no secret is present in configuration backup; revoked principals/clients remain revoked; unknown or stale policy/config keeps readiness closed", "configuration manifest; identity/PDP export; negative auth tests; readiness evidence", "OPEN" ] ] }, "bullets": [ "External egress, Kafka/webhook/provider publication and production credentials are prohibited in the restore environment.", "Sample tenant A and tenant B independently; validate that recovered exports, keys/policies, audit and evidence remain tenant-bound.", "Do not invent RPO/RTO in this contract: approved BIA/SLO owns objectives, while each exercise records actual measured values and variance.", "Destroy the isolated exercise environment only through the approved evidence-preserving cleanup process." ] }, { "id": "security-activation-checklist", "title": "Activation checklist", "table": { "caption": "A22.3 production activation gates", "columns": [ "Gate", "Owner", "Status", "Required evidence" ], "rows": [ [ "SOURCE_ACCEPTANCE_LEDGER_COMPLETE", "Product Security", "OPEN", "Every applicable A15–A22 report acceptance criterion maps to a control, current test/evidence reference, owner and explicit gap." ], [ "API_THREAT_MODEL_APPROVED", "CISO delegate", "OPEN", "Reviewed data-flow/abuse-case model covers every deployed API/version/environment and names residual risk owners." ], [ "A22_1_IAM_GATES_CLOSED", "Identity Platform", "OPEN", "Every certarail.production-iam-design.v1 activation gate is closed with immutable evidence." ], [ "A22_2_NETWORK_SECRETS_GATES_CLOSED", "Platform Security", "OPEN", "Every certarail.production-network-secrets-design.v1 activation gate is closed with immutable evidence." ], [ "AUTHORIZATION_MATRIX_PASSED", "Application Security", "OPEN", "Positive and negative operation-to-scope/RBAC/resource/property tests pass against the immutable production candidate." ], [ "TENANT_ESCAPE_MATRIX_PASSED", "Application Security", "OPEN", "Two-tenant HTTP/domain/RLS/cache/Kafka/job/export/support/restore matrix passes with a non-owner runtime role." ], [ "RESOURCE_ABUSE_CAPACITY_ACCEPTED", "SRE", "OPEN", "Measured byte/parser/concurrency/rate/database/export/queue/retry limits preserve fairness and approved SLOs." ], [ "AUDIT_PIPELINE_ACCEPTED", "Security Operations", "OPEN", "External append-only/WORM-equivalent sink, SIEM delivery/gap alerting, retention/access controls and secret-canary tests pass." ], [ "INCIDENT_EXERCISES_ACCEPTED", "Incident Commander", "OPEN", "Tabletop and technical exercises cover identity, tenant escape, exhaustion, provider/webhook, KMS/Vault, data, audit, supply chain and break-glass." ], [ "RESTORE_OBJECTIVES_ACCEPTED", "SRE", "OPEN", "Observed isolated restores satisfy approved BIA/SLO RPO/RTO and every declared invariant; backup creation alone does not close this gate." ], [ "OBSERVABILITY_AND_ON_CALL_READY", "SRE", "OPEN", "Control health, saturation, authorization denies, audit gaps, revocation, recovery and dependency alerts page named owners and link runbooks." ], [ "INDEPENDENT_REVIEW_COMPLETE", "CISO delegate", "OPEN", "Independent signed report and retest close all Critical/High findings; lower findings have explicit risk owner, decision and expiry." ], [ "ACTIVATION_AND_ROLLBACK_SIGNED", "System Owner + CISO delegate", "OPEN", "Immutable candidate digest, go/no-go record, staged activation, rollback criteria, kill path and post-activation verification are approved." ] ] }, "callout": { "tone": "critical", "title": "Checklist не является approval", "description": "Every row is OPEN. Status may change only through a signed, immutable evidence record bound to exact source/build/config candidate digests and the named authority; repository edits alone cannot close a gate." } }, { "id": "independent-security-review", "title": "Independent review plan", "lead": "Status: NOT_PERFORMED; reviewer: NOT_SELECTED. Reviewer and final approver must not be the control author, production administrator, key custodian or finding owner; conflicts are disclosed.", "table": { "caption": "Independent assessment contract", "columns": [ "Area", "Fixed plan" ], "rows": [ [ "Scope", "API architecture, data flows, trust boundaries and threat model; Human/workload IAM, scopes/RBAC/resource policy and privileged access; Tenant isolation through HTTP, domain, PostgreSQL RLS, cache, Kafka, jobs, exports and restore; TLS/private network/CORS/egress, KMS/HSM, Vault, rotation and revocation; Resource-consumption, sensitive-flow abuse and provider/webhook security; Audit/SIEM/WORM, incident response, backup/restore and supply chain" ], [ "Methods", "THREAT_MODEL_AND_ARCHITECTURE_REVIEW, SOURCE_AND_CONFIGURATION_REVIEW, AUTHENTICATED_API_PENETRATION_TEST, TENANT_ESCAPE_TEST, CLOUD_IAM_NETWORK_KMS_VAULT_REVIEW, RESOURCE_ABUSE_AND_RESILIENCE_TEST, OBSERVED_INCIDENT_EXERCISE, OBSERVED_RESTORE_EXERCISE, SUPPLY_CHAIN_AND_PROVENANCE_REVIEW" ], [ "Inputs", "Immutable source commit, build/image digest, SBOM and provenance; A15–A22 source acceptance ledger and versioned machine contracts; Production-like topology/config exports with secrets redacted by construction; Test manifests, raw transcripts, metrics, audit manifests and drill receipts; Data classification, BIA/SLO, retention, incident and access-review decisions" ], [ "Rules of engagement", "Named systems, tenants, source addresses, time window, stop conditions and incident contacts; Synthetic/canary data and credentials; no real asset movement or provider/regulator effect; Production-safe validation only by explicit written scope; destructive tests run in an isolated production-like environment; Findings and evidence use approved encrypted channels and retention; secrets are never embedded in the report" ], [ "Deliverables", "Signed scope and independence/conflict declaration; Finding register with stable ID, severity, affected asset/control, evidence and reproducible safe steps; Remediation owner, due date and explicit risk acceptance authority; Independent retest evidence and residual-risk statement; Final activation recommendation bound to exact candidate digests" ], [ "Cadence", "Before first Production activation; At least annually after activation; After material identity, authorization, tenant, network, cryptographic, recovery or provider-boundary change; After a severe incident or evidence of control bypass" ], [ "Exit criteria", "All Critical and High findings are independently retested closed. Any remaining finding has named risk owner, signed decision, compensating controls and expiry; the final report is bound to the exact activation candidate." ] ] }, "bullets": [ "Authors may approve: false.", "Production testing default: PROHIBITED_UNLESS_EXPLICITLY_APPROVED_IN_RULES_OF_ENGAGEMENT; destructive: PROHIBITED; real effects: PROHIBITED.", "Finding severity combines technical exploitability with CertaRail tenant, regulatory, financial/evidence and availability impact; the report preserves reproducible safe evidence." ] }, { "id": "security-controls-evidence-register", "title": "Evidence register", "lead": "Repository checks below are exact locators, not stored pass claims. Run outputs must record command, timestamp, toolchain, immutable source digest, environment and result; production evidence stays separate.", "table": { "caption": "Current repository checks and their proof boundary", "columns": [ "Check", "Level", "Command", "Files", "Proves" ], "rows": [ [ "HTTP_AUTHENTICATION_AND_TENANT_BINDING", "REPOSITORY_TEST", "go test ./internal/httpapi -run 'Test(AuthenticateRequiresOneCanonicalBearerHeader|AuthenticateRejectsUnknownMultiBuyerCredential|EvaluationRejectsTenantOutsideCredentialBinding)$'", "internal/httpapi/handler_test.go, internal/httpapi/tenantauth_test.go", "Current Local bearer grammar and server-derived tenant rejection paths only; not production OIDC/mTLS." ], [ "AUTHORIZATION_AND_MAKER_CHECKER", "REPOSITORY_TEST", "go test ./internal/httpapi -run 'Test(CorporateOnboardingDraftHTTPEnforcesRoleAndSessionBinding|SelfServiceSandboxHTTPRequiresDedicatedIssuerRole|CorporateDealScenarioRejectsApprovalEventMismatch)$'", "internal/httpapi/corporate_onboarding_draft_test.go, internal/httpapi/self_service_sandbox_test.go, internal/httpapi/deal_scenarios_test.go", "Selected current role/session and approval boundaries; not the complete production operation-to-policy matrix." ], [ "HTTP_AND_DOMAIN_TENANT_ISOLATION", "REPOSITORY_TEST", "go test ./internal/httpapi -run 'Test(ExtendedRoutesRejectTenantOutsideCredentialBinding|CorporateBoundaryScopesReadsAndMutationsToAuthenticatedOrganization|AssetLinkCreateRejectsClientSelectedSubjectAndCrossTenant)$'", "internal/httpapi/extensions_test.go, internal/httpapi/corporate_test.go, internal/httpapi/assetlink_test.go", "Selected public transport/domain isolation paths in the current repository." ], [ "POSTGRES_RLS_AND_DURABLE_ISOLATION", "REPOSITORY_INTEGRATION_TEST", "go test ./internal/persistence/postgresstore -run 'Test(DeveloperEvidenceDurableReplayRLSAndAppendOnlyPack|CorporateTreasuryIntegrationLifecycleReplayAndIsolation|WebhookSubscriptionDurableRestartRLSRetryAndConcurrentVerification)$'", "internal/persistence/postgresstore/developer_evidence_integration_test.go, internal/persistence/postgresstore/corporate_integration_test.go, internal/persistence/postgresstore/checkout_webhook_subscription_integration_test.go", "Selected PostgreSQL RLS/durable tenant paths when the integration database is available; not full production role inventory." ], [ "RESOURCE_ADMISSION_BACKPRESSURE_AND_DEADLINES", "REPOSITORY_TEST", "go test ./internal/httpapi -run 'Test(EvaluationRejectsOverloadWithoutQueueing|EvaluationDeadlineCancelsProcessor|ReadRoutesApplyControlBackpressureAndDeadline|TradingAdmissionPrecedesRequestBodyRead)$'", "internal/httpapi/handler_test.go, internal/httpapi/extensions_test.go, internal/httpapi/trading_test.go", "Application admission and deadlines for selected paths; not edge, distributed limiter or measured production capacity." ], [ "AUDIT_CHAIN_TAMPER_AND_FAILURE", "REPOSITORY_TEST", "go test ./internal/audit ./internal/httpapi -run 'Test(FileLogDetectsTampering|FileLogRejectsUnversionedDecision|EvaluationFailsClosedWhenAuditIsUnavailable)$'", "internal/audit/filelog_test.go, internal/httpapi/handler_test.go", "Local audit chaining and a selected fail-closed mutation; not external WORM/SIEM delivery or production retention." ], [ "WEBHOOK_SIGNATURE_REPLAY_AND_RETRY", "REPOSITORY_TEST", "go test ./internal/checkout -run 'Test(WebhookTamperAndReplayWindow|WebhookTestEventSignatureScenarios|WebhookRetryQuarantinesAtAttemptBudget)$'", "internal/checkout/service_test.go, internal/checkout/webhook_test_event_scenarios_test.go, internal/checkout/webhook_retry_test.go", "Sandbox signature/replay and retry state machines; not production endpoint egress, KMS key or worker SLO." ], [ "SCHEMA_AND_RECOVERY_GUARDS", "REPOSITORY_TEST", "go test ./internal/persistence/postgresstore -run 'Test(StoreControlScriptsFailThroughSQLRatherThanIgnoredQuitCodes|AssessSchemaCompatibilityRejectsUnverifiedContracts|StoreCheckSchemaCompatibilityFailsClosedWithoutOpenStore)$'", "internal/persistence/postgresstore/store_test.go, internal/persistence/postgresstore/schema_compatibility_test.go", "Control-script and schema-admission guards only; no backup, PITR, KMS/Vault or full restore exercise." ], [ "A15_A22_PUBLISHED_CONTRACTS", "REPOSITORY_TEST", "node --test tests/openapi-collections.test.mjs tests/asyncapi-event-catalog.test.mjs tests/production-kafka-design.test.mjs tests/self-service-sandbox.test.mjs tests/developer-console-routes.test.mjs tests/webhook-reference.test.mjs tests/production-iam-design.test.mjs tests/production-network-secrets-design.test.mjs tests/production-security-controls.test.mjs", "website/tests/openapi-collections.test.mjs, website/tests/asyncapi-event-catalog.test.mjs, website/tests/production-kafka-design.test.mjs, website/tests/self-service-sandbox.test.mjs, website/tests/developer-console-routes.test.mjs, website/tests/webhook-reference.test.mjs, website/tests/production-iam-design.test.mjs, website/tests/production-network-secrets-design.test.mjs, website/tests/production-security-controls.test.mjs", "Repository acceptance lineage and deterministic publication only; it does not close production-like or independent evidence gates." ] ] }, "bullets": [ "PRODUCTION_LIKE_AUTHORIZATION_AND_TENANT_MATRIX · OPEN · Immutable-candidate execution with production IdP/PDP, non-owner RLS role, cache, Kafka, workers, exports and support access.", "MEASURED_RESOURCE_ABUSE_AND_CAPACITY · OPEN · Signed load profile, limits, fairness/SLO results, cost budgets, edge and dependency saturation evidence.", "EXTERNAL_AUDIT_SINK_AND_INCIDENT_DRILLS · OPEN · WORM-equivalent/SIEM manifests, secret canaries, gap alerts and completed technical incident exercises.", "OBSERVED_RESTORE_AND_FAILOVER · OPEN · Isolated production-like restore/failover evidence meeting approved BIA/SLO objectives and invariants.", "INDEPENDENT_REVIEW_AND_RETEST · OPEN · Independent signed scope, findings, remediation/retest and residual-risk recommendation bound to candidate digests." ] } ] }