access-engine/docs/audit-delivery-native-proof-packet.md

# Access decision emission native proof packet — unsigned preparation

Owner scope FLEX-WP-0031-T08; source maker receipt FLEX-WP-ADHOC-2026-10-11-T03.
No execution/go, credential issuance, receiver registration or observer admission
is present. Access INTENT requires decision-source evidence; it does not authorize
Access to attest receiver custody, Platform grants or independent observer findings.

## Artifact pins and outstanding exact owner fields

Source candidate manifest:
90d5b7e962da046f205cdfa3267c25d22539c500c537c89033aefa568c3c5e16.
Completed own preparation anchor c8a376688402c817bc4c26195c61626a676abef9.
Before approval, fill each missing field from its actual owner with digest/receipt.
Do not substitute this template or an arbitrary configured URL for owner evidence.

| Required field | Current evidence / exact return needed |
| --- | --- |
| Applied source/CI artifact | Source candidates staged; source commit after independent reviews and immutable CI image containing GH-DEC-2026-024 + reviewed chart required. |
| Runtime pin inventory | Reconcile actual deployed pins with historical six registrations and FLEX-WP-0036 runtime rename; selected pin's exact namespace/name/labels/policy+registry/image required. |
| Receiver identity and scope | AUDIT-WP-0013-T02 owns exact admitted source, tenant wildcard justification, write true/read false, secret_policy redact, heartbeat classes and allow cadence thresholds. |
| Credential custody | Governed existing per-pin Secret/key reference and rotation/revoke receipt; no bearer values. Owner source of mount and usable attended routing must be reviewed before credentials. |
| Receiver + DNS route | Exact URL, receiver namespace/app label/Service and target port, DNS namespace/k8s-app label, matching ingress and transport trust from current estate owners. |
| Durable state | Exact PVC/free-disk/capacity/retention/backup, single writer, Recreate availability window, owner recovery plan; 1Gi chart default is not measured capacity. |
| Consumer stance | Current exact PEP scope/stance before rollout; unavailable PDP can cause open-for-scope proceed. Founder explicitly reviews that outcome. |
| Test scope and founder go | Exact image/rendered manifests, affected pin, window, authorized injected commit failure/restart/token revocation and non-production heartbeat withholding. |
| Independent findings identity | Separately admitted receiver/observer route; sender writer read=false cannot become blanket archive-reader. |

## Native sequence and acceptance ledger

1. Record pre-state Deployment/PVC/cursor/outbox/receiver inventory and all exact
   approved revisions. Confirm mandatory source code in immutable running image,
   durable filesystem and sender mount without exposing Secret data.
2. Generate separately approved real allow and restrictive policy requests.
   Record decision IDs, submitted/full binding digests, effect, local outbox event
   IDs and committed counters. Match exact receiver source/class/event identity,
   accepted202 and same-ID duplicate200; receiver storage receipt is independent.
3. Confirm token reread rotation and current wrong-source/tenant/read denials,
   then former-valid credential rejection under explicit owner revocation scope.
   HTTP403 policy refusal differs from DNS/transport errors; no body/token logs.
4. Restart within approved availability window; preserve PVC and cursor, stable
   pending IDs, committed counters and bounded backlog drain. Acknowledged replay
   must not duplicate custody; disk/cursor failure must retain pending evidence.
5. Exercise approved required-recorder commit failure on all five decision effects:
   each withheld as unavailable/503, no Explain leak or released-uncommitted
   increment. Verify actual PEP outage result against its current declared stance.
   Do not call 503 denial. Restore commit health and preserve all committed data.
6. Verify each rare class heartbeat source/data.class/correlation/time in custody.
   A distinct admitted non-production withheld-heartbeat trial produces the
   independent receiver silence finding. Daily source cadence alone is no finding.
7. Reconciliation remains gated on comparable time basis: receiver accepted_at
   windows and producer commit-time windows differ. Require receiver-approved
   stable accepted-at receipts (including duplicates) or exact matching basis before
   comparator/native count evidence. Undrained lag is not count loss.
8. Record rollback/recovery and retention: preserve PVC/committed pending records,
   inspect lag and cursor before disabling worker, do not recover availability by
   deploying historical pre-mandatory failure-path release. Cleanup owner proof
   must name actual custody revocation and retained evidence outcome.

Any transport failure, unverifiable custody, mismatched image/source/class,
missing restart/revocation/silence receipt or unresolved time basis remains
incomplete. Local renderer/Go tests or maker receipt cannot replace this sequence.
No values pin or sender payload is created here and no contacts are requested.
KG-WP-0005 is Qonto runtime observer work; its source tests/operational wait cannot
approve Access's native decision-source emission. Access G2 stays open.