access-engine/docs/audit-delivery-rollout-preparation.md

# Decision emitter delivery: bounded rollout preparation

Work item FLEX-WP-0031-T08, preparation only. Native custody/rollout remains wait.

## Exact source delta

GH-DEC-2026-024 mandatory-commit behavior is already source implemented: with a
required recorder, every effect waits for durable append; append failure withholds
all effects as ErrRecordNotCommitted/HTTP 503 and exposes no Explain result.
Standalone without a recorder stays standalone, not conformant native emission.
The sender worker already persists per-class daily heartbeat and drains with
stable event/idempotency IDs, token reread per event, refused redirects and durable
cursor after 200/202. Local source suites pass; no live proof follows from them.

The chart previously had outbox/PVC plumbing but no mounted sender credential,
delivery flags or receiver/DNS egress. The staged delta adds disabled-by-default
`auditDelivery`: exact URL, existing admitted Secret/key, read-only 0440 directory
mount (no subPath so rotation remains visible), and exact reviewed receiver/DNS
namespace+pod selectors/port. It creates no Secret, token, sender registration or
production values override. Enabling requires enabled single-writer outbox plus
explicit custody and network coordinates. Current scope is the `serve` command;
`serve-readback` does not implement those flags and is refused at render time.
The existing caller-auth egress rule is preserved independently.

Actual renderer tests cover auth-disabled/auth-enforced mounts and flags, narrowed
peers, absent defaults, no generated Secret, enabled-without-outbox refusal,
missing custody/network fields, unsupported readback and unsafe endpoint shape.
Existing mandatory-commit/emission/HTTP API Go suites pass. These are source proof.

## Native package still required, with no invented coordinates

Audit Core AUDIT-WP-0013-T02 must admit final per-pin source/tenant/class/cadence
payloads, secret-policy redact, writer true/read false and explicit namespace/pod
selectors. Final source-chosen allow expected-rate thresholds remain required.
The six historically named pins are ops-warden, tenant-engine, user-engine,
secrets-engine, informed-decision-t03, informed-decision-sitting; runtime inventory
must be reconciled against current deployed pins/renames before exact rollout.
No registration payloads or demand thresholds are invented in this preparation.

Platform/route owners must return a governed existing per-pin Secret/key custody
mount, admitted attended mint/delivery route and read/revocation receipts. The old
draft audit-core-senders route is not executable admission. No credential was
requested. Audit/network owners must review receiver URL, concrete namespace/pod
labels, Service/target port and DNS selector against current estate; source chart
fields are not a native route. Matching receiver ingress must be supplied.

Founder go must name immutable CI image from reviewed mandatory-commit plus chart
source, per-pin policy/registry/image provenance, exact rendered Deployment/PVC/
NetworkPolicy changes, free disk/PVC capacity, backup/restore and single-writer
Recreate availability window. Existing source image references do not establish
that GH-DEC-2026-024 code is deployed. Preserve PVC during rollback; disable drain
without erasing committed pending evidence, inspect cursor/oldest lag first.
Do not roll back to pre-mandatory failure release to regain availability.

## Required same-trial receipts

Use approved native test scope to generate allowed and restrictive decisions;
show their durable committed records and same event IDs in receiver custody,
native accepted 202 and duplicate 200, restart/cursor preservation and bounded
backlog drain. Induce separately admitted outbox commit failure to verify every
effect withheld/HTTP 503, no uncommitted Explain result or release counter, then
recovery without losing committed records. Observe each consumer's declared
outage stance: open-for-scope PEPs may proceed on unavailable PDP, so 503 must
never be reported as enforcement denial. Raw bearer/error bodies stay absent.

Receiver evidence must distinguish wrong source/tenant/read refusal, real former
credential revocation and missing per-class heartbeat findings from transport
failure. Receiver owned counts use acceptance-time windows, local emitter counts
use commit-time timestamps: without compatible time basis or durable accepted_at
receipts (including duplicate receipts), no reconciliation comparator may claim
loss/completeness. T06 remains separately blocked; undrained lag is not divergence.
Native cadence state stays declared-not-yet-emitting until actual acceptance.

KG-WP-0005 concerns the Qonto deployed stream and demands runtime-originated
startup, allow/deny transition, periodic heartbeat and same-instance receiver
mapping/reconciliation, followed by independent findings. It illustrates observer
proof requirements but is not Access's native observer approval or an emitter
handoff. This source delta produces neither Qonto records nor observer acceptance.
Access T08 needs its separately admitted native heartbeat/drain and deliberate
non-production withheld-heartbeat silence finding; T04 G2 cannot close from tests.


## Port validation correction after independent Platform review

The original prepared chart used integer conversion for bounds, which truncated
fractional YAML/JSON numbers and admitted invalid NetworkPolicy ports. Revision 2
requires a decimal integer-shaped rendered value before bounds 1..65535. Tests
exercise 8000.5, 1.5 and 65535.5 plus boolean/null/negative/out-of-range/named values
through both YAML overlays and --set-json. Explicit CLI integer bounds 1/8000/65535
render numeric ports. Original stage manifest f4ce9aa88b517d5bfe3e97ff19c62d0bf61f5872fd9c58b6770978961083b293 remains immutable.
No defaults, rotation mount, credential delivery or native activation changed.