Prepare reviewed audit delivery chart and native acceptance packet

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

charts/flex-auth/templates/deployment.yaml

@@ -1,3 +1,17 @@
+{{- if .Values.auditDelivery.enabled }}
+{{- if ne (first .Values.args) "serve" }}
+{{- fail "auditDelivery currently supports serve decision pins only" }}
+{{- end }}
+{{- if not .Values.outbox.enabled }}
+{{- fail "auditDelivery requires enabled durable outbox" }}
+{{- end }}
+{{- if not (regexMatch "^https?://[^/?#@]+/v1/events$" .Values.auditDelivery.url) }}
+{{- fail "auditDelivery.url must be an explicit http(s) /v1/events endpoint" }}
+{{- end }}
+{{- if or (not (hasPrefix "/" .Values.auditDelivery.mountPath)) (contains ".." .Values.auditDelivery.mountPath) }}
+{{- fail "auditDelivery.mountPath must be an absolute normalized directory" }}
+{{- end }}
+{{- end }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -44,6 +58,12 @@ spec:
             - --emission-source
             - {{ required "outbox.source is required when outbox.enabled=true" .Values.outbox.source | quote }}
             {{- end }}
+            {{- if .Values.auditDelivery.enabled }}
+            - --audit-url
+            - {{ .Values.auditDelivery.url | quote }}
+            - --audit-token-file
+            - {{ printf "%s/token" .Values.auditDelivery.mountPath | quote }}
+            {{- end }}
             {{- if eq (include "flex-auth.callerAuth.enabled" .) "true" }}
             {{- $binding := "" }}
             {{- if not (and .Values.readback .Values.readback.enabled) }}
@@ -87,8 +107,13 @@ spec:
               drop:
                 - ALL
             readOnlyRootFilesystem: true
-          {{- if or .Values.outbox.enabled (eq (include "flex-auth.callerAuth.enabled" .) "true") }}
+          {{- if or .Values.outbox.enabled .Values.auditDelivery.enabled (eq (include "flex-auth.callerAuth.enabled" .) "true") }}
           volumeMounts:
+            {{- if .Values.auditDelivery.enabled }}
+            - mountPath: {{ .Values.auditDelivery.mountPath | quote }}
+              name: flex-auth-audit
+              readOnly: true
+            {{- end }}
             {{- if .Values.outbox.enabled }}
             - mountPath: {{ .Values.outbox.mountPath | quote }}
               name: flex-auth-outbox
@@ -99,8 +124,17 @@ spec:
               readOnly: true
             {{- end }}
           {{- end }}
-      {{- if or .Values.outbox.enabled (eq (include "flex-auth.callerAuth.enabled" .) "true") }}
+      {{- if or .Values.outbox.enabled .Values.auditDelivery.enabled (eq (include "flex-auth.callerAuth.enabled" .) "true") }}
       volumes:
+        {{- if .Values.auditDelivery.enabled }}
+        - name: flex-auth-audit
+          secret:
+            secretName: {{ required "auditDelivery.secretName must name an admitted existing Secret" .Values.auditDelivery.secretName | quote }}
+            defaultMode: 0440
+            items:
+              - key: {{ required "auditDelivery.secretKey is required" .Values.auditDelivery.secretKey | quote }}
+                path: token
+        {{- end }}
         {{- if .Values.outbox.enabled }}
         - name: flex-auth-outbox
           persistentVolumeClaim:

charts/flex-auth/templates/networkpolicy.yaml

@@ -11,13 +11,42 @@ spec:
   policyTypes:
     - Ingress
     - Egress
-  {{- if eq (include "flex-auth.callerAuth.enabled" .) "true" }}
+  {{- if or .Values.auditDelivery.enabled (eq (include "flex-auth.callerAuth.enabled" .) "true") }}
   egress:
+    {{- if eq (include "flex-auth.callerAuth.enabled" .) "true" }}
     - ports:
         - port: 443
           protocol: TCP
         - port: 6443
           protocol: TCP
+    {{- end }}
+    {{- if .Values.auditDelivery.enabled }}
+    {{- if or (not (regexMatch "^[1-9][0-9]*$" (toString .Values.auditDelivery.receiverPort))) (lt (int .Values.auditDelivery.receiverPort) 1) (gt (int .Values.auditDelivery.receiverPort) 65535) }}
+    {{- fail "auditDelivery.receiverPort must be explicitly set to a valid receiver port" }}
+    {{- end }}
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: {{ required "auditDelivery.receiverNamespace is required" .Values.auditDelivery.receiverNamespace | quote }}
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: {{ required "auditDelivery.receiverPodName is required" .Values.auditDelivery.receiverPodName | quote }}
+      ports:
+        - port: {{ .Values.auditDelivery.receiverPort }}
+          protocol: TCP
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: {{ required "auditDelivery.dnsNamespace is required" .Values.auditDelivery.dnsNamespace | quote }}
+          podSelector:
+            matchLabels:
+              k8s-app: {{ required "auditDelivery.dnsPodLabel is required" .Values.auditDelivery.dnsPodLabel | quote }}
+      ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    {{- end }}
   {{- else }}
   egress: []
   {{- end }}

charts/flex-auth/values.yaml

@@ -18,6 +18,20 @@ outbox:
   storageClassName: ""
   existingClaim: ""
 
+# Inert preparation: caller provides reviewed existing Secret and exact receiver.
+# The chart never creates/mints sender credentials or registers a sender.
+auditDelivery:
+  enabled: false
+  url: ""
+  secretName: ""
+  secretKey: ""
+  mountPath: /var/run/secrets/flex-auth-audit
+  receiverNamespace: ""
+  receiverPodName: ""
+  receiverPort: 0
+  dnsNamespace: ""
+  dnsPodLabel: ""
+
 args:
   - serve
   - --addr

docs/audit-delivery-native-proof-packet.md

@@ -0,0 +1,64 @@
+# Access decision emission native proof packet — unsigned preparation
+
+Owner scope FLEX-WP-0031-T08; source maker receipt FLEX-WP-ADHOC-2026-10-11-T03.
+No execution/go, credential issuance, receiver registration or observer admission
+is present. Access INTENT requires decision-source evidence; it does not authorize
+Access to attest receiver custody, Platform grants or independent observer findings.
+
+## Artifact pins and outstanding exact owner fields
+
+Source candidate manifest:
+90d5b7e962da046f205cdfa3267c25d22539c500c537c89033aefa568c3c5e16.
+Completed own preparation anchor c8a376688402c817bc4c26195c61626a676abef9.
+Before approval, fill each missing field from its actual owner with digest/receipt.
+Do not substitute this template or an arbitrary configured URL for owner evidence.
+
+| Required field | Current evidence / exact return needed |
+| --- | --- |
+| Applied source/CI artifact | Source candidates staged; source commit after independent reviews and immutable CI image containing GH-DEC-2026-024 + reviewed chart required. |
+| Runtime pin inventory | Reconcile actual deployed pins with historical six registrations and FLEX-WP-0036 runtime rename; selected pin's exact namespace/name/labels/policy+registry/image required. |
+| Receiver identity and scope | AUDIT-WP-0013-T02 owns exact admitted source, tenant wildcard justification, write true/read false, secret_policy redact, heartbeat classes and allow cadence thresholds. |
+| Credential custody | Governed existing per-pin Secret/key reference and rotation/revoke receipt; no bearer values. Owner source of mount and usable attended routing must be reviewed before credentials. |
+| Receiver + DNS route | Exact URL, receiver namespace/app label/Service and target port, DNS namespace/k8s-app label, matching ingress and transport trust from current estate owners. |
+| Durable state | Exact PVC/free-disk/capacity/retention/backup, single writer, Recreate availability window, owner recovery plan; 1Gi chart default is not measured capacity. |
+| Consumer stance | Current exact PEP scope/stance before rollout; unavailable PDP can cause open-for-scope proceed. Founder explicitly reviews that outcome. |
+| Test scope and founder go | Exact image/rendered manifests, affected pin, window, authorized injected commit failure/restart/token revocation and non-production heartbeat withholding. |
+| Independent findings identity | Separately admitted receiver/observer route; sender writer read=false cannot become blanket archive-reader. |
+
+## Native sequence and acceptance ledger
+
+1. Record pre-state Deployment/PVC/cursor/outbox/receiver inventory and all exact
+   approved revisions. Confirm mandatory source code in immutable running image,
+   durable filesystem and sender mount without exposing Secret data.
+2. Generate separately approved real allow and restrictive policy requests.
+   Record decision IDs, submitted/full binding digests, effect, local outbox event
+   IDs and committed counters. Match exact receiver source/class/event identity,
+   accepted202 and same-ID duplicate200; receiver storage receipt is independent.
+3. Confirm token reread rotation and current wrong-source/tenant/read denials,
+   then former-valid credential rejection under explicit owner revocation scope.
+   HTTP403 policy refusal differs from DNS/transport errors; no body/token logs.
+4. Restart within approved availability window; preserve PVC and cursor, stable
+   pending IDs, committed counters and bounded backlog drain. Acknowledged replay
+   must not duplicate custody; disk/cursor failure must retain pending evidence.
+5. Exercise approved required-recorder commit failure on all five decision effects:
+   each withheld as unavailable/503, no Explain leak or released-uncommitted
+   increment. Verify actual PEP outage result against its current declared stance.
+   Do not call 503 denial. Restore commit health and preserve all committed data.
+6. Verify each rare class heartbeat source/data.class/correlation/time in custody.
+   A distinct admitted non-production withheld-heartbeat trial produces the
+   independent receiver silence finding. Daily source cadence alone is no finding.
+7. Reconciliation remains gated on comparable time basis: receiver accepted_at
+   windows and producer commit-time windows differ. Require receiver-approved
+   stable accepted-at receipts (including duplicates) or exact matching basis before
+   comparator/native count evidence. Undrained lag is not count loss.
+8. Record rollback/recovery and retention: preserve PVC/committed pending records,
+   inspect lag and cursor before disabling worker, do not recover availability by
+   deploying historical pre-mandatory failure-path release. Cleanup owner proof
+   must name actual custody revocation and retained evidence outcome.
+
+Any transport failure, unverifiable custody, mismatched image/source/class,
+missing restart/revocation/silence receipt or unresolved time basis remains
+incomplete. Local renderer/Go tests or maker receipt cannot replace this sequence.
+No values pin or sender payload is created here and no contacts are requested.
+KG-WP-0005 is Qonto runtime observer work; its source tests/operational wait cannot
+approve Access's native decision-source emission. Access G2 stays open.

docs/audit-delivery-rollout-preparation.md

@@ -0,0 +1,91 @@
+# Decision emitter delivery: bounded rollout preparation
+
+Work item FLEX-WP-0031-T08, preparation only. Native custody/rollout remains wait.
+
+## Exact source delta
+
+GH-DEC-2026-024 mandatory-commit behavior is already source implemented: with a
+required recorder, every effect waits for durable append; append failure withholds
+all effects as ErrRecordNotCommitted/HTTP 503 and exposes no Explain result.
+Standalone without a recorder stays standalone, not conformant native emission.
+The sender worker already persists per-class daily heartbeat and drains with
+stable event/idempotency IDs, token reread per event, refused redirects and durable
+cursor after 200/202. Local source suites pass; no live proof follows from them.
+
+The chart previously had outbox/PVC plumbing but no mounted sender credential,
+delivery flags or receiver/DNS egress. The staged delta adds disabled-by-default
+`auditDelivery`: exact URL, existing admitted Secret/key, read-only 0440 directory
+mount (no subPath so rotation remains visible), and exact reviewed receiver/DNS
+namespace+pod selectors/port. It creates no Secret, token, sender registration or
+production values override. Enabling requires enabled single-writer outbox plus
+explicit custody and network coordinates. Current scope is the `serve` command;
+`serve-readback` does not implement those flags and is refused at render time.
+The existing caller-auth egress rule is preserved independently.
+
+Actual renderer tests cover auth-disabled/auth-enforced mounts and flags, narrowed
+peers, absent defaults, no generated Secret, enabled-without-outbox refusal,
+missing custody/network fields, unsupported readback and unsafe endpoint shape.
+Existing mandatory-commit/emission/HTTP API Go suites pass. These are source proof.
+
+## Native package still required, with no invented coordinates
+
+Audit Core AUDIT-WP-0013-T02 must admit final per-pin source/tenant/class/cadence
+payloads, secret-policy redact, writer true/read false and explicit namespace/pod
+selectors. Final source-chosen allow expected-rate thresholds remain required.
+The six historically named pins are ops-warden, tenant-engine, user-engine,
+secrets-engine, informed-decision-t03, informed-decision-sitting; runtime inventory
+must be reconciled against current deployed pins/renames before exact rollout.
+No registration payloads or demand thresholds are invented in this preparation.
+
+Platform/route owners must return a governed existing per-pin Secret/key custody
+mount, admitted attended mint/delivery route and read/revocation receipts. The old
+draft audit-core-senders route is not executable admission. No credential was
+requested. Audit/network owners must review receiver URL, concrete namespace/pod
+labels, Service/target port and DNS selector against current estate; source chart
+fields are not a native route. Matching receiver ingress must be supplied.
+
+Founder go must name immutable CI image from reviewed mandatory-commit plus chart
+source, per-pin policy/registry/image provenance, exact rendered Deployment/PVC/
+NetworkPolicy changes, free disk/PVC capacity, backup/restore and single-writer
+Recreate availability window. Existing source image references do not establish
+that GH-DEC-2026-024 code is deployed. Preserve PVC during rollback; disable drain
+without erasing committed pending evidence, inspect cursor/oldest lag first.
+Do not roll back to pre-mandatory failure release to regain availability.
+
+## Required same-trial receipts
+
+Use approved native test scope to generate allowed and restrictive decisions;
+show their durable committed records and same event IDs in receiver custody,
+native accepted 202 and duplicate 200, restart/cursor preservation and bounded
+backlog drain. Induce separately admitted outbox commit failure to verify every
+effect withheld/HTTP 503, no uncommitted Explain result or release counter, then
+recovery without losing committed records. Observe each consumer's declared
+outage stance: open-for-scope PEPs may proceed on unavailable PDP, so 503 must
+never be reported as enforcement denial. Raw bearer/error bodies stay absent.
+
+Receiver evidence must distinguish wrong source/tenant/read refusal, real former
+credential revocation and missing per-class heartbeat findings from transport
+failure. Receiver owned counts use acceptance-time windows, local emitter counts
+use commit-time timestamps: without compatible time basis or durable accepted_at
+receipts (including duplicate receipts), no reconciliation comparator may claim
+loss/completeness. T06 remains separately blocked; undrained lag is not divergence.
+Native cadence state stays declared-not-yet-emitting until actual acceptance.
+
+KG-WP-0005 concerns the Qonto deployed stream and demands runtime-originated
+startup, allow/deny transition, periodic heartbeat and same-instance receiver
+mapping/reconciliation, followed by independent findings. It illustrates observer
+proof requirements but is not Access's native observer approval or an emitter
+handoff. This source delta produces neither Qonto records nor observer acceptance.
+Access T08 needs its separately admitted native heartbeat/drain and deliberate
+non-production withheld-heartbeat silence finding; T04 G2 cannot close from tests.
+
+
+## Port validation correction after independent Platform review
+
+The original prepared chart used integer conversion for bounds, which truncated
+fractional YAML/JSON numbers and admitted invalid NetworkPolicy ports. Revision 2
+requires a decimal integer-shaped rendered value before bounds 1..65535. Tests
+exercise 8000.5, 1.5 and 65535.5 plus boolean/null/negative/out-of-range/named values
+through both YAML overlays and --set-json. Explicit CLI integer bounds 1/8000/65535
+render numeric ports. Original stage manifest f4ce9aa88b517d5bfe3e97ff19c62d0bf61f5872fd9c58b6770978961083b293 remains immutable.
+No defaults, rotation mount, credential delivery or native activation changed.

docs/reviews/2026-10-11-audit-delivery-chart-maker.md

@@ -0,0 +1,46 @@
+# Access source maker receipt: inert audit delivery chart revision 2
+
+reviewer: access-engine-owner (agent access-engine, codex)
+decision: approved
+work_item: FLEX-WP-ADHOC-2026-10-11-T03
+anchor_commit: c8a376688402c817bc4c26195c61626a676abef9
+anchor_sha256: be19dec8bc278e6fd3173175b864a309ac67c49b8c4be1d5b3b319b8b3e2c43a
+scope: bounded own-source readiness/maker receipt, not independent Platform approval
+
+Comment: Access INTENT Responsibility Boundary requires the sole PDP to publish
+its decision records while custody and protected effects remain with their owners.
+This chart fills existing source delivery plumbing without choosing authority or
+manufacturing evidence: it mounts an existing admitted sender Secret by name/key,
+passes the already implemented sender flags and admits exact owner-supplied
+receiver/DNS selectors. Disabled defaults remain disabled. No credential mint,
+sender registration, policy version or production values/image is introduced.
+This completed T03 own work record was persisted before this receipt. I approve
+only the exact source candidates in the immutable revision 2 manifest below.
+
+Reviewed manifest SHA256:
+90d5b7e962da046f205cdfa3267c25d22539c500c537c89033aefa568c3c5e16
+at /tmp/access-audit-delivery-v2-stage/manifest.json. Verified all seven candidate
+hashes against it. Original manifest f4ce9aa88b517d5bfe3e97ff19c62d0bf61f5872fd9c58b6770978961083b293 is preserved as failed-review history.
+
+Independent Platform finding: integer conversion admitted fractional YAML/JSON
+ports and rendered invalid Kubernetes NetworkPolicy. Revision 2 requires decimal
+integer shape before bounds 1..65535. Actual YAML and --set-json tests reject
+8000.5, 1.5, 65535.5, booleans/null and out-of-range/non-numeric values. Renderer
+regressions passed, including valid integer boundaries, auth on/off, existing
+read-only directory Secret mount (no subPath, rotation visible), disabled defaults,
+required source/custody/network fields, unsafe URL and unsupported serve-readback
+refusal. Helm lint passed. Original preparation's mandatory-commit decision,
+emission, readback, HTTP/API Go suites passed; port repair changes no Go source.
+
+This is the maker's bounded source receipt, not independent cross-owner approval.
+Platform's fresh delta review remains required; it is neither inferred from this
+receipt nor written in Platform's role. Source application/publication, native
+receiver/custody/go and runtime proof remain pending. No deployable immutable CI
+image, sender admission, Secret delivery, current network selectors or native
+202/200/revoke/restart/silence receipts are established here.
+
+Required-recorder mandatory-commit source withholds every effect on failed append
+and returns unavailable/HTTP503; this is not denial at an open-for-scope consumer.
+No attached recorder means standalone behavior, not a conformant evidence lane.
+FLEX-WP-0031-T08 remains wait, T06 receiver time basis remains unresolved, and
+T04/G2 cannot close from this receipt. No native or credential operation occurred.

tests/test_outbox_chart.py

@@ -1,6 +1,8 @@
 #!/usr/bin/env python3
 """Render the optional outbox with caller auth on/off, without cluster access."""
 import subprocess
+import tempfile
+from pathlib import Path
 import yaml
 
 
@@ -48,3 +50,73 @@ assert any(v.get("persistentVolumeClaim", {}).get("claimName") == "retained-outb
 render(*enabled, "replicaCount=2", succeeds=False)
 render("outbox.enabled=true", succeeds=False)
 print("optional outbox chart checks passed")
+
+# Delivery rendering binds an existing admitted credential mount and narrow peers.
+audit = ("auditDelivery.enabled=true", "auditDelivery.url=http://receiver.test:8000/v1/events",
+         "auditDelivery.secretName=approved-test-sender", "auditDelivery.secretKey=sender-token",
+         "auditDelivery.receiverNamespace=test-receiver", "auditDelivery.receiverPodName=test-audit",
+         "auditDelivery.receiverPort=8000", "auditDelivery.dnsNamespace=test-dns",
+         "auditDelivery.dnsPodLabel=test-dns")
+for auth in ((), ("callerAuth.mode=enforce", "callerAuth.binding=test=system:serviceaccount:test:test")):
+    documents = render(*enabled, *audit, *auth)
+    pod = deployment(documents)["spec"]["template"]["spec"]
+    container = pod["containers"][0]
+    args = container["args"]
+    assert args[args.index("--audit-url")+1] == "http://receiver.test:8000/v1/events"
+    assert args[args.index("--audit-token-file")+1] == "/var/run/secrets/flex-auth-audit/token"
+    credential = next(v for v in pod["volumes"] if v["name"] == "flex-auth-audit")["secret"]
+    assert credential == {"secretName":"approved-test-sender", "defaultMode":288,
+                          "items":[{"key":"sender-token", "path":"token"}]}
+    assert next(v for v in container["volumeMounts"] if v["name"] == "flex-auth-audit")["readOnly"] is True
+    assert not any(d["kind"] == "Secret" for d in documents)
+    network = next(d for d in documents if d["kind"] == "NetworkPolicy")["spec"]
+    receiver = next(rule for rule in network["egress"] if rule.get("ports") == [{"port":8000,"protocol":"TCP"}])
+    assert receiver["to"] == [{"namespaceSelector":{"matchLabels":{"kubernetes.io/metadata.name":"test-receiver"}},
+                              "podSelector":{"matchLabels":{"app.kubernetes.io/name":"test-audit"}}}]
+    dns = next(rule for rule in network["egress"] if len(rule.get("ports",[])) == 2 and rule["ports"][0]["port"] == 53)
+    assert dns["to"][0]["namespaceSelector"]["matchLabels"]["kubernetes.io/metadata.name"] == "test-dns"
+    assert dns["to"][0]["podSelector"]["matchLabels"]["k8s-app"] == "test-dns"
+render(*enabled, *audit, "args[0]=serve-readback", succeeds=False)
+render(*audit, succeeds=False)
+for invalid in ("auditDelivery.secretName=", "auditDelivery.secretKey=", "auditDelivery.receiverNamespace=",
+                "auditDelivery.receiverPodName=", "auditDelivery.receiverPort=0", "auditDelivery.dnsNamespace=",
+                "auditDelivery.dnsPodLabel=", "auditDelivery.url=http://user:pass@receiver/v1/events",
+                "auditDelivery.url=http://receiver/v1/events?x=1", "auditDelivery.mountPath=relative"):
+    render(*enabled, *audit, invalid, succeeds=False)
+for document in base:
+    if document["kind"] == "Deployment":
+        assert "--audit-url" not in document["spec"]["template"]["spec"]["containers"][0]["args"]
+print("inert scoped audit delivery chart checks passed")
+
+# YAML/JSON numeric values must never be truncated into invalid Kubernetes ports.
+# CLI --set integer paths alone do not cover float/bool/null decoder values.
+for port in (8000.5, 1.5, 65535.5, True, False, None, 0, -1, 65536, "8000.5", "named-port"):
+    for encoding in ("yaml", "json"):
+        command = ["helm", "template", "flex-auth", "charts/flex-auth", "-f", "values/stage2-canary.yaml"]
+        for setting in (*enabled, *audit):
+            if not setting.startswith("auditDelivery.receiverPort="):
+                command += ["--set", setting]
+        if encoding == "json":
+            import json
+            command += ["--set-json", "auditDelivery.receiverPort=" + json.dumps(port)]
+            result = subprocess.run(command, capture_output=True, text=True, check=False)
+        else:
+            # Later -f overrides existing YAML; no --set receiverPort override.
+            command = ["helm", "template", "flex-auth", "charts/flex-auth", "-f", "values/stage2-canary.yaml"]
+            for setting in (*enabled, *audit):
+                if not setting.startswith("auditDelivery.receiverPort="):
+                    command += ["--set", setting]
+            with tempfile.TemporaryDirectory() as directory:
+                overlay = Path(directory) / "port.yaml"
+                overlay.write_text(yaml.safe_dump({"auditDelivery":{"receiverPort":port}}))
+                command += ["-f", str(overlay)]
+                result = subprocess.run(command, capture_output=True, text=True, check=False)
+        assert result.returncode != 0, f"{encoding} accepted non-integer/out-of-range port {port!r}"
+        assert "receiverPort" in result.stderr, result.stderr
+for port in (1, 8000, 65535):
+    documents = render(*enabled, *audit, f"auditDelivery.receiverPort={port}")
+    policy = next(d for d in documents if d["kind"] == "NetworkPolicy")
+    scoped = next(rule for rule in policy["spec"]["egress"]
+                  if rule.get("to", [{}])[0].get("podSelector",{}).get("matchLabels",{}).get("app.kubernetes.io/name") == "test-audit")
+    assert type(scoped["ports"][0]["port"]) is int and scoped["ports"][0]["port"] == port
+print("receiver port integer/type boundary checks passed")

workplans/ADHOC-2026-10-11.md

@@ -102,3 +102,13 @@ this completed source-characterization/repair record does not close T08, issue
 credentials, approve native rollout or grant owner acceptance. Persist this own
 record before formal Access review of the revised source. T06 reconciliation
 and T04 G2 remain open; open-for-scope consumers may proceed on PDP 503.
+
+
+After T03 persistence in commit `c8a376688402c817bc4c26195c61626a676abef9`,
+prepared the bounded Access maker/source receipt in
+`docs/reviews/2026-10-11-audit-delivery-chart-maker.md` for exact immutable v2
+manifest `90d5b7e962da046f205cdfa3267c25d22539c500c537c89033aefa568c3c5e16`.
+Independent Platform delta acceptance remains external. Prepared unsigned exact
+native proof field/sequence packet `docs/audit-delivery-native-proof-packet.md`;
+no CI/image, custody, route, owner go or native receiver result is fabricated.
+T08/T06/T04 stay open and unavailable PDP/open-stance behavior remains explicit.

workplans/FLEX-WP-0031-decision-record-emission.md

@@ -319,3 +319,22 @@ stances rather than claim that a 503 enforces denial. T02 native sender/custody,
 T06 compatible reconciliation windows, T08 exact approved rollout and silence
 proof, and T04 G2 closure remain unfinished. `cadence.yaml` remains declared,
 and the emission completeness gap remains open until native acceptance.
+
+
+### T08 independent chart delivery preparation — 2026-10-11
+
+Prepared inert chart `auditDelivery` configuration for existing admitted per-pin
+Secret/key directory mount, explicit /v1/events endpoint and narrow receiver/DNS
+egress. Supports existing `serve` pins only; unsupported readback flags refuse.
+No pin defaults, native rollout, credential or sender registration changes.
+Renderer tests pass for auth on/off, safe mounts/scoped peers, disabled defaults
+and invalid/partial configurations. Mandatory-commit/emission/readback/HTTP/API
+Go suites pass. Exact remaining image/PVC/custody/network/receiver and same-trial
+native receipts are in `docs/audit-delivery-rollout-preparation.md`.
+T08 remains wait; T06 receiver time basis and T04 native G2 acceptance remain open.
+
+
+T08 preparation revision 2: independent Platform review found fractional YAML/
+JSON receiver ports could survive integer truncation and render invalid Kubernetes
+NetworkPolicy. Corrected integer-shape guard plus 22 YAML/JSON rejection cases
+and integer boundary rendering passed. Original stage retained; no native change.