Prepare reviewed audit delivery chart and native acceptance packet

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

docs/audit-delivery-native-proof-packet.md

@@ -0,0 +1,64 @@
+# Access decision emission native proof packet — unsigned preparation
+
+Owner scope FLEX-WP-0031-T08; source maker receipt FLEX-WP-ADHOC-2026-10-11-T03.
+No execution/go, credential issuance, receiver registration or observer admission
+is present. Access INTENT requires decision-source evidence; it does not authorize
+Access to attest receiver custody, Platform grants or independent observer findings.
+
+## Artifact pins and outstanding exact owner fields
+
+Source candidate manifest:
+90d5b7e962da046f205cdfa3267c25d22539c500c537c89033aefa568c3c5e16.
+Completed own preparation anchor c8a376688402c817bc4c26195c61626a676abef9.
+Before approval, fill each missing field from its actual owner with digest/receipt.
+Do not substitute this template or an arbitrary configured URL for owner evidence.
+
+| Required field | Current evidence / exact return needed |
+| --- | --- |
+| Applied source/CI artifact | Source candidates staged; source commit after independent reviews and immutable CI image containing GH-DEC-2026-024 + reviewed chart required. |
+| Runtime pin inventory | Reconcile actual deployed pins with historical six registrations and FLEX-WP-0036 runtime rename; selected pin's exact namespace/name/labels/policy+registry/image required. |
+| Receiver identity and scope | AUDIT-WP-0013-T02 owns exact admitted source, tenant wildcard justification, write true/read false, secret_policy redact, heartbeat classes and allow cadence thresholds. |
+| Credential custody | Governed existing per-pin Secret/key reference and rotation/revoke receipt; no bearer values. Owner source of mount and usable attended routing must be reviewed before credentials. |
+| Receiver + DNS route | Exact URL, receiver namespace/app label/Service and target port, DNS namespace/k8s-app label, matching ingress and transport trust from current estate owners. |
+| Durable state | Exact PVC/free-disk/capacity/retention/backup, single writer, Recreate availability window, owner recovery plan; 1Gi chart default is not measured capacity. |
+| Consumer stance | Current exact PEP scope/stance before rollout; unavailable PDP can cause open-for-scope proceed. Founder explicitly reviews that outcome. |
+| Test scope and founder go | Exact image/rendered manifests, affected pin, window, authorized injected commit failure/restart/token revocation and non-production heartbeat withholding. |
+| Independent findings identity | Separately admitted receiver/observer route; sender writer read=false cannot become blanket archive-reader. |
+
+## Native sequence and acceptance ledger
+
+1. Record pre-state Deployment/PVC/cursor/outbox/receiver inventory and all exact
+   approved revisions. Confirm mandatory source code in immutable running image,
+   durable filesystem and sender mount without exposing Secret data.
+2. Generate separately approved real allow and restrictive policy requests.
+   Record decision IDs, submitted/full binding digests, effect, local outbox event
+   IDs and committed counters. Match exact receiver source/class/event identity,
+   accepted202 and same-ID duplicate200; receiver storage receipt is independent.
+3. Confirm token reread rotation and current wrong-source/tenant/read denials,
+   then former-valid credential rejection under explicit owner revocation scope.
+   HTTP403 policy refusal differs from DNS/transport errors; no body/token logs.
+4. Restart within approved availability window; preserve PVC and cursor, stable
+   pending IDs, committed counters and bounded backlog drain. Acknowledged replay
+   must not duplicate custody; disk/cursor failure must retain pending evidence.
+5. Exercise approved required-recorder commit failure on all five decision effects:
+   each withheld as unavailable/503, no Explain leak or released-uncommitted
+   increment. Verify actual PEP outage result against its current declared stance.
+   Do not call 503 denial. Restore commit health and preserve all committed data.
+6. Verify each rare class heartbeat source/data.class/correlation/time in custody.
+   A distinct admitted non-production withheld-heartbeat trial produces the
+   independent receiver silence finding. Daily source cadence alone is no finding.
+7. Reconciliation remains gated on comparable time basis: receiver accepted_at
+   windows and producer commit-time windows differ. Require receiver-approved
+   stable accepted-at receipts (including duplicates) or exact matching basis before
+   comparator/native count evidence. Undrained lag is not count loss.
+8. Record rollback/recovery and retention: preserve PVC/committed pending records,
+   inspect lag and cursor before disabling worker, do not recover availability by
+   deploying historical pre-mandatory failure-path release. Cleanup owner proof
+   must name actual custody revocation and retained evidence outcome.
+
+Any transport failure, unverifiable custody, mismatched image/source/class,
+missing restart/revocation/silence receipt or unresolved time basis remains
+incomplete. Local renderer/Go tests or maker receipt cannot replace this sequence.
+No values pin or sender payload is created here and no contacts are requested.
+KG-WP-0005 is Qonto runtime observer work; its source tests/operational wait cannot
+approve Access's native decision-source emission. Access G2 stays open.

docs/audit-delivery-rollout-preparation.md

@@ -0,0 +1,91 @@
+# Decision emitter delivery: bounded rollout preparation
+
+Work item FLEX-WP-0031-T08, preparation only. Native custody/rollout remains wait.
+
+## Exact source delta
+
+GH-DEC-2026-024 mandatory-commit behavior is already source implemented: with a
+required recorder, every effect waits for durable append; append failure withholds
+all effects as ErrRecordNotCommitted/HTTP 503 and exposes no Explain result.
+Standalone without a recorder stays standalone, not conformant native emission.
+The sender worker already persists per-class daily heartbeat and drains with
+stable event/idempotency IDs, token reread per event, refused redirects and durable
+cursor after 200/202. Local source suites pass; no live proof follows from them.
+
+The chart previously had outbox/PVC plumbing but no mounted sender credential,
+delivery flags or receiver/DNS egress. The staged delta adds disabled-by-default
+`auditDelivery`: exact URL, existing admitted Secret/key, read-only 0440 directory
+mount (no subPath so rotation remains visible), and exact reviewed receiver/DNS
+namespace+pod selectors/port. It creates no Secret, token, sender registration or
+production values override. Enabling requires enabled single-writer outbox plus
+explicit custody and network coordinates. Current scope is the `serve` command;
+`serve-readback` does not implement those flags and is refused at render time.
+The existing caller-auth egress rule is preserved independently.
+
+Actual renderer tests cover auth-disabled/auth-enforced mounts and flags, narrowed
+peers, absent defaults, no generated Secret, enabled-without-outbox refusal,
+missing custody/network fields, unsupported readback and unsafe endpoint shape.
+Existing mandatory-commit/emission/HTTP API Go suites pass. These are source proof.
+
+## Native package still required, with no invented coordinates
+
+Audit Core AUDIT-WP-0013-T02 must admit final per-pin source/tenant/class/cadence
+payloads, secret-policy redact, writer true/read false and explicit namespace/pod
+selectors. Final source-chosen allow expected-rate thresholds remain required.
+The six historically named pins are ops-warden, tenant-engine, user-engine,
+secrets-engine, informed-decision-t03, informed-decision-sitting; runtime inventory
+must be reconciled against current deployed pins/renames before exact rollout.
+No registration payloads or demand thresholds are invented in this preparation.
+
+Platform/route owners must return a governed existing per-pin Secret/key custody
+mount, admitted attended mint/delivery route and read/revocation receipts. The old
+draft audit-core-senders route is not executable admission. No credential was
+requested. Audit/network owners must review receiver URL, concrete namespace/pod
+labels, Service/target port and DNS selector against current estate; source chart
+fields are not a native route. Matching receiver ingress must be supplied.
+
+Founder go must name immutable CI image from reviewed mandatory-commit plus chart
+source, per-pin policy/registry/image provenance, exact rendered Deployment/PVC/
+NetworkPolicy changes, free disk/PVC capacity, backup/restore and single-writer
+Recreate availability window. Existing source image references do not establish
+that GH-DEC-2026-024 code is deployed. Preserve PVC during rollback; disable drain
+without erasing committed pending evidence, inspect cursor/oldest lag first.
+Do not roll back to pre-mandatory failure release to regain availability.
+
+## Required same-trial receipts
+
+Use approved native test scope to generate allowed and restrictive decisions;
+show their durable committed records and same event IDs in receiver custody,
+native accepted 202 and duplicate 200, restart/cursor preservation and bounded
+backlog drain. Induce separately admitted outbox commit failure to verify every
+effect withheld/HTTP 503, no uncommitted Explain result or release counter, then
+recovery without losing committed records. Observe each consumer's declared
+outage stance: open-for-scope PEPs may proceed on unavailable PDP, so 503 must
+never be reported as enforcement denial. Raw bearer/error bodies stay absent.
+
+Receiver evidence must distinguish wrong source/tenant/read refusal, real former
+credential revocation and missing per-class heartbeat findings from transport
+failure. Receiver owned counts use acceptance-time windows, local emitter counts
+use commit-time timestamps: without compatible time basis or durable accepted_at
+receipts (including duplicate receipts), no reconciliation comparator may claim
+loss/completeness. T06 remains separately blocked; undrained lag is not divergence.
+Native cadence state stays declared-not-yet-emitting until actual acceptance.
+
+KG-WP-0005 concerns the Qonto deployed stream and demands runtime-originated
+startup, allow/deny transition, periodic heartbeat and same-instance receiver
+mapping/reconciliation, followed by independent findings. It illustrates observer
+proof requirements but is not Access's native observer approval or an emitter
+handoff. This source delta produces neither Qonto records nor observer acceptance.
+Access T08 needs its separately admitted native heartbeat/drain and deliberate
+non-production withheld-heartbeat silence finding; T04 G2 cannot close from tests.
+
+
+## Port validation correction after independent Platform review
+
+The original prepared chart used integer conversion for bounds, which truncated
+fractional YAML/JSON numbers and admitted invalid NetworkPolicy ports. Revision 2
+requires a decimal integer-shaped rendered value before bounds 1..65535. Tests
+exercise 8000.5, 1.5 and 65535.5 plus boolean/null/negative/out-of-range/named values
+through both YAML overlays and --set-json. Explicit CLI integer bounds 1/8000/65535
+render numeric ports. Original stage manifest f4ce9aa88b517d5bfe3e97ff19c62d0bf61f5872fd9c58b6770978961083b293 remains immutable.
+No defaults, rotation mount, credential delivery or native activation changed.

docs/reviews/2026-10-11-audit-delivery-chart-maker.md

@@ -0,0 +1,46 @@
+# Access source maker receipt: inert audit delivery chart revision 2
+
+reviewer: access-engine-owner (agent access-engine, codex)
+decision: approved
+work_item: FLEX-WP-ADHOC-2026-10-11-T03
+anchor_commit: c8a376688402c817bc4c26195c61626a676abef9
+anchor_sha256: be19dec8bc278e6fd3173175b864a309ac67c49b8c4be1d5b3b319b8b3e2c43a
+scope: bounded own-source readiness/maker receipt, not independent Platform approval
+
+Comment: Access INTENT Responsibility Boundary requires the sole PDP to publish
+its decision records while custody and protected effects remain with their owners.
+This chart fills existing source delivery plumbing without choosing authority or
+manufacturing evidence: it mounts an existing admitted sender Secret by name/key,
+passes the already implemented sender flags and admits exact owner-supplied
+receiver/DNS selectors. Disabled defaults remain disabled. No credential mint,
+sender registration, policy version or production values/image is introduced.
+This completed T03 own work record was persisted before this receipt. I approve
+only the exact source candidates in the immutable revision 2 manifest below.
+
+Reviewed manifest SHA256:
+90d5b7e962da046f205cdfa3267c25d22539c500c537c89033aefa568c3c5e16
+at /tmp/access-audit-delivery-v2-stage/manifest.json. Verified all seven candidate
+hashes against it. Original manifest f4ce9aa88b517d5bfe3e97ff19c62d0bf61f5872fd9c58b6770978961083b293 is preserved as failed-review history.
+
+Independent Platform finding: integer conversion admitted fractional YAML/JSON
+ports and rendered invalid Kubernetes NetworkPolicy. Revision 2 requires decimal
+integer shape before bounds 1..65535. Actual YAML and --set-json tests reject
+8000.5, 1.5, 65535.5, booleans/null and out-of-range/non-numeric values. Renderer
+regressions passed, including valid integer boundaries, auth on/off, existing
+read-only directory Secret mount (no subPath, rotation visible), disabled defaults,
+required source/custody/network fields, unsafe URL and unsupported serve-readback
+refusal. Helm lint passed. Original preparation's mandatory-commit decision,
+emission, readback, HTTP/API Go suites passed; port repair changes no Go source.
+
+This is the maker's bounded source receipt, not independent cross-owner approval.
+Platform's fresh delta review remains required; it is neither inferred from this
+receipt nor written in Platform's role. Source application/publication, native
+receiver/custody/go and runtime proof remain pending. No deployable immutable CI
+image, sender admission, Secret delivery, current network selectors or native
+202/200/revoke/restart/silence receipts are established here.
+
+Required-recorder mandatory-commit source withholds every effect on failed append
+and returns unavailable/HTTP503; this is not denial at an open-for-scope consumer.
+No attached recorder means standalone behavior, not a conformant evidence lane.
+FLEX-WP-0031-T08 remains wait, T06 receiver time basis remains unresolved, and
+T04/G2 cannot close from this receipt. No native or credential operation occurred.