Lab: answer a question your log is too young to answer

The audit lab showed how to prove a log is complete and unmodified. This one is about the other half of that claim, which is the period it covers, and it is the half people discover during an audit rather than before one.

1. 1

   Set a retention window and ask two questions across it.

   bash Copy

   cat > /tmp/ret.py <<'EOF'
   import datetime
   
   RETENTION_DAYS = 90
   today  = datetime.date(2026, 9, 7)
   cutoff = today - datetime.timedelta(days=RETENTION_DAYS)
   
   events = [{"date": datetime.date(2026, 2, 14), "actor": "mallory", "target": "prod/db/root"},
             {"date": datetime.date(2026, 7,  2), "actor": "deploy",  "target": "app/config"}]
   kept = [e for e in events if e["date"] >= cutoff]
   
   print(f"today {today}, retention {RETENTION_DAYS}d, cutoff {cutoff}")
   print(f"events still in the log: {len(kept)} of {len(events)}\n")
   
   for label, start, end in [("Q3 (Jul-Sep)", datetime.date(2026,7,1), datetime.date(2026,9,30)),
                             ("Q1 (Jan-Mar)", datetime.date(2026,1,1), datetime.date(2026,3,31))]:
       hits = [e for e in kept if start <= e["date"] <= end and e["target"] == "prod/db/root"]
       covered = start >= cutoff
       print(f"  {label}: {len(hits)} matching event(s)   log covers this period: {covered}")
   EOF
   python3 /tmp/ret.py

2. 2

   Both queries returned zero for prod/db/root. Only one of those zeros means anything.

   text Copy

   today 2026-09-07, retention 90d, cutoff 2026-06-09
   events still in the log: 1 of 2
   
     Q3 (Jul-Sep): 0 matching event(s)   log covers this period: True
     Q1 (Jan-Mar): 0 matching event(s)   log covers this period: False

3. 3

   Clean up.

   bash Copy

   rm /tmp/ret.py

There was a read of prod/db/root in February. It is not in the answer because it is not in the log, and a query that returns nothing looks identical whether the event never happened or the record was aged out.

• Negative assurance needs three things, not two: no matching event, a log that is complete and unmodified, and a retention window that actually covers the period in question.
• Default retention is usually months and regulators usually ask about years, which is a mismatch you want to discover before the request rather than during it.
• Any query tool should report the window it searched alongside the result. An empty result set with no stated coverage is not an answer.