access-engine/docs/audit-delivery-native-proof-packet.md

Access decision emission native proof packet — unsigned preparation

Owner scope FLEX-WP-0031-T08; source maker receipt FLEX-WP-ADHOC-2026-10-11-T03. No execution/go, credential issuance, receiver registration or observer admission is present. Access INTENT requires decision-source evidence; it does not authorize Access to attest receiver custody, Platform grants or independent observer findings.

Artifact pins and outstanding exact owner fields

Source candidate manifest: 90d5b7e962da046f205cdfa3267c25d22539c500c537c89033aefa568c3c5e16. Completed own preparation anchor c8a3766884. Before approval, fill each missing field from its actual owner with digest/receipt. Do not substitute this template or an arbitrary configured URL for owner evidence.

Required field	Current evidence / exact return needed
Applied source/CI artifact	Source candidates staged; source commit after independent reviews and immutable CI image containing GH-DEC-2026-024 + reviewed chart required.
Runtime pin inventory	Reconcile actual deployed pins with historical six registrations and FLEX-WP-0036 runtime rename; selected pin's exact namespace/name/labels/policy+registry/image required.
Receiver identity and scope	AUDIT-WP-0013-T02 owns exact admitted source, tenant wildcard justification, write true/read false, secret_policy redact, heartbeat classes and allow cadence thresholds.
Credential custody	Governed existing per-pin Secret/key reference and rotation/revoke receipt; no bearer values. Owner source of mount and usable attended routing must be reviewed before credentials.
Receiver + DNS route	Exact URL, receiver namespace/app label/Service and target port, DNS namespace/k8s-app label, matching ingress and transport trust from current estate owners.
Durable state	Exact PVC/free-disk/capacity/retention/backup, single writer, Recreate availability window, owner recovery plan; 1Gi chart default is not measured capacity.
Consumer stance	Current exact PEP scope/stance before rollout; unavailable PDP can cause open-for-scope proceed. Founder explicitly reviews that outcome.
Test scope and founder go	Exact image/rendered manifests, affected pin, window, authorized injected commit failure/restart/token revocation and non-production heartbeat withholding.
Independent findings identity	Separately admitted receiver/observer route; sender writer read=false cannot become blanket archive-reader.

Native sequence and acceptance ledger

1. Record pre-state Deployment/PVC/cursor/outbox/receiver inventory and all exact approved revisions. Confirm mandatory source code in immutable running image, durable filesystem and sender mount without exposing Secret data.
2. Generate separately approved real allow and restrictive policy requests. Record decision IDs, submitted/full binding digests, effect, local outbox event IDs and committed counters. Match exact receiver source/class/event identity, accepted202 and same-ID duplicate200; receiver storage receipt is independent.
3. Confirm token reread rotation and current wrong-source/tenant/read denials, then former-valid credential rejection under explicit owner revocation scope. HTTP403 policy refusal differs from DNS/transport errors; no body/token logs.
4. Restart within approved availability window; preserve PVC and cursor, stable pending IDs, committed counters and bounded backlog drain. Acknowledged replay must not duplicate custody; disk/cursor failure must retain pending evidence.
5. Exercise approved required-recorder commit failure on all five decision effects: each withheld as unavailable/503, no Explain leak or released-uncommitted increment. Verify actual PEP outage result against its current declared stance. Do not call 503 denial. Restore commit health and preserve all committed data.
6. Verify each rare class heartbeat source/data.class/correlation/time in custody. A distinct admitted non-production withheld-heartbeat trial produces the independent receiver silence finding. Daily source cadence alone is no finding.
7. Reconciliation remains gated on comparable time basis: receiver accepted_at windows and producer commit-time windows differ. Require receiver-approved stable accepted-at receipts (including duplicates) or exact matching basis before comparator/native count evidence. Undrained lag is not count loss.
8. Record rollback/recovery and retention: preserve PVC/committed pending records, inspect lag and cursor before disabling worker, do not recover availability by deploying historical pre-mandatory failure-path release. Cleanup owner proof must name actual custody revocation and retained evidence outcome.

Any transport failure, unverifiable custody, mismatched image/source/class, missing restart/revocation/silence receipt or unresolved time basis remains incomplete. Local renderer/Go tests or maker receipt cannot replace this sequence. No values pin or sender payload is created here and no contacts are requested. KG-WP-0005 is Qonto runtime observer work; its source tests/operational wait cannot approve Access's native decision-source emission. Access G2 stays open.