IP

Server-derived brand

innovate PCI shell

Audit timeline

Audit observability, event-type counts, immutable event details, conflict states, and re-auth prompts.

Organization
Innovate Lab Tenant
Entity
ent_innovate_platform_lab
Scope
server-derived registry scope
Role
pci_operator
Stage
lab
Active theme
Pay Theory
Technical details
brand_pointer
partner://innovate/brand/lab/v2026-05-01
asset_pointer
https://assets.innovate.test/pci/
brand_reasons
none

Partner brand service

Loading partner-owned brand manifest from /api/session/brand.

Brand API
/api/session/brand
Boundary
No browser tenant authority, brand override authority, theme mutation, asset upload, endpoint value, account identifier, physical id, secret, live-data path, or fallback browser storage.

Trusted tenant context

Tenant authority: trusted API session

Tenant: pci_tnt_innovate_lab; partner: innovate; stage: lab; registry version: 3.

No viewer authority inputs were used.

PRD-384 permission matrix

Server-derived navigation and actions

hidden-not-disabled

Role-specific navigation and actions are projected from /api/permissions/matrix. The browser cannot supply tenant, entity, role, signer, or forwarded-header authority; never-allowed actions are omitted from the shell instead of rendered disabled.

Matrix source
api_server_derived_from_session_registry_context
Primary role lane
pci_operator from server matrix metadata
Visible actions
8
Suppressed actions
1 action(s) withheld without client-side disabled controls.
Viewer role accepted
false
Signer input accepted
false

Step-up reauthentication handoff

When the server-derived permission matrix marks an action as requiring step-up, this shell sends the operator to the same-origin PCI API/BFF step-up route. The browser never constructs Autheory authorize URLs and never supplies tenant, role, principal, subject, MFA, freshness, or permission authority.

  • Override inherited answer Reauthenticate Only sensitive_action=answer.override is sent as a non-authoritative retry hint.
  • Queue audit export Reauthenticate Only sensitive_action=operator.audit_export is sent as a non-authoritative retry hint.
Step-up initiate
/api/session/step-up
Callback boundary
/api/session/callback is API/BFF-owned after provider reauthentication.
Allowed browser hint
sensitive_action / action only; the API must re-check session, CSRF policy for unsafe service retries, tenant registry, permissions, and freshness.
Visible server-allowed actions
ActionCategoryStep-upReason
Review tenant tenant server authorized role_allows_tenant_review
Review evidence package evidence server authorized role_allows_evidence_review
Create evidence metadata intake evidence server authorized role_allows_evidence_upload_metadata
Answer questionnaire assessment server authorized role_allows_answer
Override inherited answer assessment server step-up required operator_step_up_required
Invite submerchant onboarding server authorized operator_scope_review_required
Save workflow state workflow server authorized role_allows_workflow_metadata_save
Queue audit export audit server step-up required role_allows_operator_audit_export_metadata
  • auth.session_refreshed

Module status

  • Data Collection enabled / primary Data Collection is enabled by trusted session context.
  • Monitoring enabled / integrated Monitoring is enabled by trusted session context.
Admin audit timelineVerified

Audit timeline verified

Audit state remains server-derived and record-only; viewer-supplied tenant, audit stream, event, signing, export, queue, notification, or upload authority is not accepted.

Accepted
Audit reason codes
reason_code_1
none
Audit observability service details

Product hardening audit observability API

Audit observability service

Loading trusted-session audit observability, event-type, authority, downstream, and boundary state from /api/audit/observability-state with a read-only GET.

Browser authority
none
Request policy
trusted-session-no-query-no-body-no-viewer-authority-no-browser-audit-observability-mutation
Fallback state
The audit timeline remains visible if the observability API is unavailable.
Observability panels
PanelStateSafe message
Observed audit event types from service
Event typeCount
Audit authority from service
Authority areaState
Audit downstream seams from service
SeamState
Audit content boundary from service
BoundaryState
    Ledger authorityServer derived

    Audit ledger authority view

    Timeline: audit-timeline://cycle_lab_2026_readiness/app-view; API shape: service-ref://api/audit-ledger/timeline/m6.9.

    AcceptedVerified
    Authority
    audit-ledger-service
    Display policy
    record-only-no-browser-authority
    Tenant/stage
    pci_tnt_innovate_lab / lab
    4

    Immutable event metadata refs

    100%
    AcceptedVerified

    Ledger verification state

    AcceptedAnchored

    Anchor manifest state

    5

    Operator review tasks

    Blocked — action needed
    Audit-driven operator workbenchread-only-ledger-to-workspace-routing

    Review work from ledger events

    Use ledger events to jump into assessment, evidence, AOC, and workflow screens. This section creates no audit records and accepts no viewer-provided tenant, event, or object authority.

    Ready for review
    Operator review tasks from audit events
    Review itemObject/ownerStateBoundaryOpen workspace
    Confirm trusted session refresh
    Review refs
    action_ref
    audit-review://cycle_lab_2026_readiness/session-refresh
    event_ref
    aud_evt_session_refresh_040
    		Operator session context
    Pci Operator    		AcceptedAcceptedSession authority is service-derived; browser-supplied tenant or account inputs remain ignored.Open workflow task board
    Review saved assessment response
    Review refs
    action_ref
    audit-review://cycle_lab_2026_readiness/response-save
    event_ref
    aud_evt_response_save_041
    		Payment-flow control answer
    Security Reviewer    		Ready for reviewReady For ReviewOpen the questionnaire row tied to this event; answer content and tenant scope are loaded by the service.Open assessment workspace
    Check evidence record linkage
    Review refs
    action_ref
    audit-review://cycle_lab_2026_readiness/evidence-metadata
    event_ref
    aud_evt_evidence_metadata_042
    		AOC evidence record
    Evidence Coordinator    		In progressOpenEvidence files are not rendered here; use the evidence workspace for scan state and response linkage.Open evidence library
    Resolve sensitive override review
    Review refs
    action_ref
    audit-review://cycle_lab_2026_readiness/reauth-required
    event_ref
    aud_evt_reauth_required_043
    		Monitoring-path override
    Security Reviewer    		Blocked — action neededBlockedOverride work remains blocked until a trusted service re-auth flow authorizes the mutation.Open assessment workspace
    Prepare AOC package review
    Review refs
    action_ref
    audit-review://cycle_lab_2026_readiness/aoc-package
    event_ref
    aud_evt_response_save_041
    		AOC review package
    Executive Reviewer    		Ready for reviewReady For ReviewReview package status, signer readiness, and export state without rendering document bodies or signatures.Open AOC review
    Hash chainAppend-only ledger

    Hash-chain and anchor summary

    Anchor, terminal hash, and reason metadata render as service-owned records; no event body or signing control is mounted.

    AcceptedVerified
    Sequence range
    40-43
    Anchor state
    AcceptedAnchored
    Verification
    AcceptedVerified
    Hash-chain reason codes
    reason_code_1
    none
    Hash-chain refs
    stream_id
    tenant:pci_tnt_innovate_lab:cycle_lab_2026_readiness
    terminal_event_hash
    sha256:9090909090909090909090909090909090909090909090909090909090909090
    anchor_manifest_ref
    audit-anchor://cycle_lab_2026_readiness/range-40-43/metadata
    TimelineHash and record only

    Audit timeline

    Events render as immutable audit ledger records. Payloads, source object contents, and mutation controls are not rendered.

    Accepted
    SeqEvent summaryOccurredProducer/typeImmutable stateHash details
    40Trusted session context was refreshed; viewer-supplied authority inputs remain ignored.
    Event refs
    audit_event_id
    aud_evt_session_refresh_040
    detail_ref
    audit-detail://cycle_lab_2026_readiness/session-refresh-040
    		Lab sample timestamp: 2026-05-06T13:00Zpci-platform-api
    auth.session_refreshed    		AcceptedAppend Only Verified
    AcceptedVerified
    Event hashes
    payload_hash
    sha256:2020202020202020202020202020202020202020202020202020202020202020
    previous_event_hash
    sha256:1010101010101010101010101010101010101010101010101010101010101010
    event_hash
    sha256:3030303030303030303030303030303030303030303030303030303030303030
    41Assessment response metadata was written through the service seam and locked append-only.
    Event refs
    audit_event_id
    aud_evt_response_save_041
    detail_ref
    audit-detail://cycle_lab_2026_readiness/response-save-041
    		Lab sample timestamp: 2026-05-06T13:05Zpci-platform-compliance-service
    assessment.response_saved    		AcceptedWrite Once Locked
    AcceptedVerified
    Event hashes
    payload_hash
    sha256:4040404040404040404040404040404040404040404040404040404040404040
    previous_event_hash
    sha256:3030303030303030303030303030303030303030303030303030303030303030
    event_hash
    sha256:5050505050505050505050505050505050505050505050505050505050505050
    42Evidence metadata ref was accepted; no underlying object or document content is rendered.
    Event refs
    audit_event_id
    aud_evt_evidence_metadata_042
    detail_ref
    audit-detail://cycle_lab_2026_readiness/evidence-metadata-042
    		Lab sample timestamp: 2026-05-06T13:10Zpci-platform-evidence-service
    evidence.metadata_accepted    		AcceptedAppend Only Verified
    AcceptedVerified
    Event hashes
    payload_hash
    sha256:6060606060606060606060606060606060606060606060606060606060606060
    previous_event_hash
    sha256:5050505050505050505050505050505050505050505050505050505050505050
    event_hash
    sha256:7070707070707070707070707070707070707070707070707070707070707070
    43Sensitive assessment override requires fresh authentication before any mutation can be attempted.
    Event refs
    audit_event_id
    aud_evt_reauth_required_043
    detail_ref
    audit-detail://cycle_lab_2026_readiness/reauth-required-043
    		Lab sample timestamp: 2026-05-06T13:12Zpci-platform-api
    assessment.override_reauth_required    		AcceptedWrite Once Locked
    AcceptedVerified
    Event hashes
    payload_hash
    sha256:8080808080808080808080808080808080808080808080808080808080808080
    previous_event_hash
    sha256:7070707070707070707070707070707070707070707070707070707070707070
    event_hash
    sha256:9090909090909090909090909090909090909090909090909090909090909090
    Technical detailsNo payload bodies

    Immutable event details

    Canonicalization, hashes, actor refs, and object refs are shown as record-only details; browser state does not become audit authority.

    Accepted
    Detail refActor refObject refPayload hashPrevious hashEvent hashCanonicalizationRender policy
    audit-detail://cycle_lab_2026_readiness/session-refresh-040principal
    Actor ref
    principal_ref
    principal-ref://pci_prn_innovate_operator_001
    		session
    Object ref
    object_ref
    session-ref://hash-only/session-refresh
    		sha256:2020202020202020202020202020202020202020202020202020202020202020sha256:1010101010101010101010101010101010101010101010101010101010101010sha256:3030303030303030303030303030303030303030303030303030303030303030audit-json-c14n-2026-05-01AcceptedVerified
    hash-and-record-only
    audit-detail://cycle_lab_2026_readiness/response-save-041principal
    Actor ref
    principal_ref
    principal-ref://pci_prn_innovate_operator_001
    		assessment_response
    Object ref
    object_ref
    response-group://cycle_lab_2026_readiness/submerchant-a/payment-flow
    		sha256:4040404040404040404040404040404040404040404040404040404040404040sha256:3030303030303030303030303030303030303030303030303030303030303030sha256:5050505050505050505050505050505050505050505050505050505050505050audit-json-c14n-2026-05-01AcceptedVerified
    hash-and-record-only
    audit-detail://cycle_lab_2026_readiness/evidence-metadata-042service
    Actor ref
    principal_ref
    service-ref://pci-platform-evidence-service
    		evidence_metadata
    Object ref
    object_ref
    evidence-ref://cycle_lab_2026_readiness/aoc-metadata
    		sha256:6060606060606060606060606060606060606060606060606060606060606060sha256:5050505050505050505050505050505050505050505050505050505050505050sha256:7070707070707070707070707070707070707070707070707070707070707070audit-json-c14n-2026-05-01AcceptedVerified
    hash-and-record-only
    audit-detail://cycle_lab_2026_readiness/reauth-required-043principal
    Actor ref
    principal_ref
    principal-ref://pci_prn_innovate_operator_001
    		sensitive_mutation
    Object ref
    object_ref
    sensitive-mutation://assessment/override/monitoring-path
    		sha256:8080808080808080808080808080808080808080808080808080808080808080sha256:7070707070707070707070707070707070707070707070707070707070707070sha256:9090909090909090909090909090909090909090909090909090909090909090audit-json-c14n-2026-05-01AcceptedVerified
    hash-and-record-only
    Conflict stateNo open conflicts

    Audit conflict state

    No audit conflicts are present.

    Accepted
    Sensitive mutation promptsDisplay only

    Sensitive mutation re-auth prompts

    Prompts are display-only service prompts. No form action, live request, local storage, queue, or mutation control is mounted by this app shell.

    Ready for review
    Mutation refSurfacePrompt stateRequired factorAudit eventExpiresPolicy
    sensitive-mutation://assessment/override/monitoring-pathAssessment OverrideReady for reviewReauth RequiredFresh Session Or Step Upaud_evt_reauth_required_043Lab sample prompt expiry: 2026-05-06T14:12Z
    Prompt policy
    reason_code
    sensitive_assessment_override
    render_policy
    prompt-display-only-no-form-action

    PCI application shell with reviewed same-origin service-backed metadata GETs and CSRF-bound workflow actions for onboarding, scope, assessment, evidence, AOC, reporting, and acceptance review. Tenant authority remains server-derived. No deploy behavior: this screen does not run deploys, payment traffic, partner-edge changes, external queues, notifications, or sandbox/live operations.