05.4 — Compliance & resilience

The Invariant

Every resilience claim maps to a queryable mechanism. Hash chains, node heartbeats, signed ingest evidence — auditors verify against live tables and public endpoints, not slides.

The Contract

Parameter	Mechanism (verifiable)
Write durability (edge)	Business write + audit row + `ax_cdc_outbox` commit in the same transaction — a fact either exists with its evidence or does not exist
Cloud RPO	`pg_dump` on the deployment’s backup schedule (see `docs/DEPLOY.md` in the repo — the runbook is the canonical procedure, not a sidecar)
Edge recovery	`restart: unless-stopped` container policy + zero-touch re-claim (`bt_*` bootstrap token) — a node rejoins signed and drains its outbox
Cloud recovery	Idempotent schema migrations at boot + readiness probe `GET /api/v1/ready`

Audit surfaces: cp_admin_audit (append-only, hash-chained admin mutations), ax_audit_log on the edge (hash-chained operator actions), cp_ingest_batches (preserved signed envelopes), GET /api/v1/public/verify/event/:id (third-party verification without credentials), GET …/tenant/audit + …/audit/verify (self-service chain export and re-verification), tenant/admin audit-webhooks (signed push to your SIEM).

The Flow

edge blackout → commits stay local (outbox durable) → reconnect → drain (dedup absorbs replay)
cloud failure → redeploy → migrations converge → /api/v1/ready
tampering    → any rewritten audit row breaks the hash chain → verify exposes the gap

Payload Example

# The integrity evidence an auditor runs — no credentials needed
curl -s https://cp.axiom-trace.eu/api/v1/public/verify/event/$EVENT_ID | jq .

# Tenant-side: re-verify the admin action chain end-to-end
curl -s https://cp.axiom-trace.eu/api/v1/tenant/audit/verify \
  -H "Authorization: Bearer $PS" | jq '{ok, checked, head}'

Known Failures

Compliance mapping — with the honest boundaries:

Framework	What Axiom-Trace provides	Honest boundary
ISO-9001 audits	Attributable integrity evidence per plant node	Evidence, not qualified legal proof
GDPR	Oracle answers with zero leakage — no `tenant_id`, no payload, no secrets	Data-controller obligations stay with the tenant
NIS2	Edge→cloud chain-of-custody, tamper-evident telemetry, immediate key revocation	Organizational measures remain the customer’s

Transport: TLS terminates at the reverse proxy (see docs/DEPLOY.md for the Caddy reference); payload integrity is additionally guaranteed at application layer — the per-node Ed25519 signature covers the raw request body, so transport is not the trust anchor.