access-engine/docs/contracts/decision-emission-cadence.json

{
  "schema_version": "0.1",
  "declaration_id": "flex-auth-decision-emission-cadence-v0.1",
  "source": "flex-auth",
  "sources": [
    {
      "source_id": "flex-auth:deny",
      "event_class": "flex-auth.decision.deny",
      "form": "heartbeat-or-reconciliation",
      "reconciliation": {
        "compare_local": "committed outbox counts per class, tenant and explicit since/until window, with pending deliveries counted as lag",
        "compare_observed": "audit-core GET /v1/reconciliation for the exact pin source and tenant, once receiver acceptance-time windows are compatible with local counts; time-basis contract pending",
        "divergence": "finding",
        "undrained_local": "lag-not-divergence"
      },
      "extensions": {
        "netkingdom": {
          "evidence_class": "load-bearing",
          "rate_monitoring": "forbidden"
        }
      },
      "heartbeat": {
        "event_class": "audit-core.heartbeat",
        "interval_seconds": 86400,
        "assertion": "nothing-to-report",
        "missing": "finding",
        "extensions": {
          "flex-auth": {
            "asserted_class": "flex-auth.decision.deny",
            "observer_registration_status": "pending"
          }
        }
      }
    },
    {
      "source_id": "flex-auth:redact",
      "event_class": "flex-auth.decision.redact",
      "form": "heartbeat-or-reconciliation",
      "reconciliation": {
        "compare_local": "committed outbox counts per class, tenant and explicit since/until window, with pending deliveries counted as lag",
        "compare_observed": "audit-core GET /v1/reconciliation for the exact pin source and tenant, once receiver acceptance-time windows are compatible with local counts; time-basis contract pending",
        "divergence": "finding",
        "undrained_local": "lag-not-divergence"
      },
      "extensions": {
        "netkingdom": {
          "evidence_class": "load-bearing",
          "rate_monitoring": "forbidden"
        }
      },
      "heartbeat": {
        "event_class": "audit-core.heartbeat",
        "interval_seconds": 86400,
        "assertion": "nothing-to-report",
        "missing": "finding",
        "extensions": {
          "flex-auth": {
            "asserted_class": "flex-auth.decision.redact",
            "observer_registration_status": "pending"
          }
        }
      }
    },
    {
      "source_id": "flex-auth:not_applicable",
      "event_class": "flex-auth.decision.not_applicable",
      "form": "heartbeat-or-reconciliation",
      "reconciliation": {
        "compare_local": "committed outbox counts per class, tenant and explicit since/until window, with pending deliveries counted as lag",
        "compare_observed": "audit-core GET /v1/reconciliation for the exact pin source and tenant, once receiver acceptance-time windows are compatible with local counts; time-basis contract pending",
        "divergence": "finding",
        "undrained_local": "lag-not-divergence"
      },
      "extensions": {
        "netkingdom": {
          "evidence_class": "load-bearing",
          "rate_monitoring": "forbidden"
        }
      },
      "heartbeat": {
        "event_class": "audit-core.heartbeat",
        "interval_seconds": 86400,
        "assertion": "nothing-to-report",
        "missing": "finding",
        "extensions": {
          "flex-auth": {
            "asserted_class": "flex-auth.decision.not_applicable",
            "observer_registration_status": "pending"
          }
        }
      }
    },
    {
      "source_id": "flex-auth:audit_only",
      "event_class": "flex-auth.decision.audit_only",
      "form": "heartbeat-or-reconciliation",
      "reconciliation": {
        "compare_local": "committed outbox counts per class, tenant and explicit since/until window, with pending deliveries counted as lag",
        "compare_observed": "audit-core GET /v1/reconciliation for the exact pin source and tenant, once receiver acceptance-time windows are compatible with local counts; time-basis contract pending",
        "divergence": "finding",
        "undrained_local": "lag-not-divergence"
      },
      "extensions": {
        "netkingdom": {
          "evidence_class": "load-bearing",
          "rate_monitoring": "forbidden"
        }
      },
      "heartbeat": {
        "event_class": "audit-core.heartbeat",
        "interval_seconds": 86400,
        "assertion": "nothing-to-report",
        "missing": "finding",
        "extensions": {
          "flex-auth": {
            "asserted_class": "flex-auth.decision.audit_only",
            "observer_registration_status": "pending"
          }
        }
      }
    },
    {
      "source_id": "flex-auth:allow:rate",
      "event_class": "flex-auth.decision.allow",
      "form": "expected-rate",
      "window_seconds": 3600,
      "expected_min": 1,
      "drop_below": "finding",
      "extensions": {
        "netkingdom": {
          "evidence_class": "load-bearing",
          "rate_monitoring": "permitted"
        },
        "flex-auth": {
          "reconciliation": {
            "compare_local": "committed outbox counts per class, tenant and explicit since/until window, with pending deliveries counted as lag",
            "compare_observed": "audit-core GET /v1/reconciliation for the exact pin source and tenant, once receiver acceptance-time windows are compatible with local counts; time-basis contract pending",
            "divergence": "finding",
            "undrained_local": "lag-not-divergence"
          },
          "reason": "The generic expected-rate form forbids a reconciliation block; this source-owned extension preserves the additional reconciliation guarantee without a duplicate event class."
        }
      }
    }
  ],
  "extensions": {
    "flex-auth": {
      "state": "declared-not-yet-emitting",
      "gap": "G2",
      "inventory": {
        "load_bearing": [
          "flex-auth.decision.deny",
          "flex-auth.decision.redact",
          "flex-auth.decision.not_applicable",
          "flex-auth.decision.audit_only",
          "flex-auth.decision.allow"
        ],
        "rare_load_bearing": [
          "flex-auth.decision.deny",
          "flex-auth.decision.redact",
          "flex-auth.decision.not_applicable",
          "flex-auth.decision.audit_only"
        ],
        "attributive": []
      },
      "contract": {
        "owner": "info-tech-canon",
        "schema_sha256": "6d52692eb1e4d1325e0d6062d95acded98beddaae5bcfe24c6f0e91f1b6be6ae"
      },
      "lag_bound": {
        "outbox_depth": 100,
        "outbox_age": "1h",
        "exceed": "finding"
      },
      "bound": "Heartbeat and reconciliation detect loss, outage, drain failure and accident. Neither detects a compromised source suppressing an event and its own count together \u2014 \u00a79.6's stated residual, and \u00a716 puts the independent observer outside audit-core's scope. Conformance to this declaration is not a claim of stream completeness."
    }
  }
}