access-engine/docs/audit-delivery-rollout-preparation.md

Decision emitter delivery: bounded rollout preparation

Work item FLEX-WP-0031-T08, preparation only. Native custody/rollout remains wait.

Exact source delta

GH-DEC-2026-024 mandatory-commit behavior is already source implemented: with a required recorder, every effect waits for durable append; append failure withholds all effects as ErrRecordNotCommitted/HTTP 503 and exposes no Explain result. Standalone without a recorder stays standalone, not conformant native emission. The sender worker already persists per-class daily heartbeat and drains with stable event/idempotency IDs, token reread per event, refused redirects and durable cursor after 200/202. Local source suites pass; no live proof follows from them.

The chart previously had outbox/PVC plumbing but no mounted sender credential, delivery flags or receiver/DNS egress. The staged delta adds disabled-by-default auditDelivery: exact URL, existing admitted Secret/key, read-only 0440 directory mount (no subPath so rotation remains visible), and exact reviewed receiver/DNS namespace+pod selectors/port. It creates no Secret, token, sender registration or production values override. Enabling requires enabled single-writer outbox plus explicit custody and network coordinates. Current scope is the serve command; serve-readback does not implement those flags and is refused at render time. The existing caller-auth egress rule is preserved independently.

Actual renderer tests cover auth-disabled/auth-enforced mounts and flags, narrowed peers, absent defaults, no generated Secret, enabled-without-outbox refusal, missing custody/network fields, unsupported readback and unsafe endpoint shape. Existing mandatory-commit/emission/HTTP API Go suites pass. These are source proof.

Native package still required, with no invented coordinates

Audit Core AUDIT-WP-0013-T02 must admit final per-pin source/tenant/class/cadence payloads, secret-policy redact, writer true/read false and explicit namespace/pod selectors. Final source-chosen allow expected-rate thresholds remain required. The six historically named pins are ops-warden, tenant-engine, user-engine, secrets-engine, informed-decision-t03, informed-decision-sitting; runtime inventory must be reconciled against current deployed pins/renames before exact rollout. No registration payloads or demand thresholds are invented in this preparation.

Platform/route owners must return a governed existing per-pin Secret/key custody mount, admitted attended mint/delivery route and read/revocation receipts. The old draft audit-core-senders route is not executable admission. No credential was requested. Audit/network owners must review receiver URL, concrete namespace/pod labels, Service/target port and DNS selector against current estate; source chart fields are not a native route. Matching receiver ingress must be supplied.

Founder go must name immutable CI image from reviewed mandatory-commit plus chart source, per-pin policy/registry/image provenance, exact rendered Deployment/PVC/ NetworkPolicy changes, free disk/PVC capacity, backup/restore and single-writer Recreate availability window. Existing source image references do not establish that GH-DEC-2026-024 code is deployed. Preserve PVC during rollback; disable drain without erasing committed pending evidence, inspect cursor/oldest lag first. Do not roll back to pre-mandatory failure release to regain availability.

Required same-trial receipts

Use approved native test scope to generate allowed and restrictive decisions; show their durable committed records and same event IDs in receiver custody, native accepted 202 and duplicate 200, restart/cursor preservation and bounded backlog drain. Induce separately admitted outbox commit failure to verify every effect withheld/HTTP 503, no uncommitted Explain result or release counter, then recovery without losing committed records. Observe each consumer's declared outage stance: open-for-scope PEPs may proceed on unavailable PDP, so 503 must never be reported as enforcement denial. Raw bearer/error bodies stay absent.

Receiver evidence must distinguish wrong source/tenant/read refusal, real former credential revocation and missing per-class heartbeat findings from transport failure. Receiver owned counts use acceptance-time windows, local emitter counts use commit-time timestamps: without compatible time basis or durable accepted_at receipts (including duplicate receipts), no reconciliation comparator may claim loss/completeness. T06 remains separately blocked; undrained lag is not divergence. Native cadence state stays declared-not-yet-emitting until actual acceptance.

KG-WP-0005 concerns the Qonto deployed stream and demands runtime-originated startup, allow/deny transition, periodic heartbeat and same-instance receiver mapping/reconciliation, followed by independent findings. It illustrates observer proof requirements but is not Access's native observer approval or an emitter handoff. This source delta produces neither Qonto records nor observer acceptance. Access T08 needs its separately admitted native heartbeat/drain and deliberate non-production withheld-heartbeat silence finding; T04 G2 cannot close from tests.

Port validation correction after independent Platform review

The original prepared chart used integer conversion for bounds, which truncated fractional YAML/JSON numbers and admitted invalid NetworkPolicy ports. Revision 2 requires a decimal integer-shaped rendered value before bounds 1..65535. Tests exercise 8000.5, 1.5 and 65535.5 plus boolean/null/negative/out-of-range/named values through both YAML overlays and --set-json. Explicit CLI integer bounds 1/8000/65535 render numeric ports. Original stage manifest f4ce9aa88b517d5bfe3e97ff19c62d0bf61f5872fd9c58b6770978961083b293 remains immutable. No defaults, rotation mount, credential delivery or native activation changed.