coulomb/approval-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Migrate owned cadence declaration to published contract

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29
This commit is contained in:
tegwick 2026-10-03 22:59:46 +02:00
parent 3abb576821
commit 931e0b3249
4 changed files with 289 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

58
docs/emission-cadence.md
View file

@ -24,7 +24,7 @@ becomes a missing positive rather than a quiet month.
| Interval | 24 hours (SHOULD also be emittable on demand) |
| Assertion | `nothing-to-report` |
| Counts | `{issuance, use, supersession, revocation}` of committed outbox rows |
| Missing heartbeat | **finding** |
| Missing heartbeat | **finding** after the requested 172800s receiver bound; registration pending |
### Reconciliation
@ -38,7 +38,7 @@ accepted event counts for `source=approval-engine` and the corresponding
| `use` | `approval.use` |
| `supersession` | `approval.supersession` |
| `revocation` | `approval.revocation` |
| `heartbeat` | `approval.heartbeat` |
| `heartbeat` | `audit-core.heartbeat` |
Undrained local rows are this engine's lag, not yet a divergence. A row
with `drained_at` set that `audit-core` does not hold is the omission
@ -46,7 +46,7 @@ case §9.6 names.
## What is a finding
- No heartbeat arrives for more than one interval.
- No per-class heartbeat arrives beyond the requested 48h receiver bound (24h emission interval).
- `audit-core` count for a class is less than this engine's drained count
for that class.
- Outbox depth or age exceeds the lag bound in `cadence.yaml` (drain stuck).
@ -59,3 +59,55 @@ Atomicity prevents accidental omission (crash between mutation and emit).
Cadence and reconciliation **detect** adversarial omission after the fact.
Nothing in the model prevents a compromised source from suppressing. That
residual is stated, not closed.
## Imported declaration and source inventory — 2026-10-03
`cadence.yaml` now uses InfoTechCanon's published candidate 0.2.0 contract,
schema 0.1, rather than the historical flattened draft. The source-owned
inventory is `extensions.approval-engine.inventory`: issuance, use,
supersession and revocation are rare load-bearing transitions; heartbeat is
the load-bearing delivery control, reconciled without a recursive heartbeat.
No evidence classification or emission interval has been relaxed.
The implementation emits four atomic `audit-core.heartbeat` events, asserting
the four transition classes through `data.class`; it does not emit
`approval.heartbeat`. Production CLI defaults to 86400s. The receiver request
in `audit-source-registration.md` remains 172800s; it is not a live admission
receipt. Lag depth 100 and age 3600s remain declared bounds, with observer
enforcement pending. Repository conformance does not prove stream completeness.
Live closure stays in APPROVAL-WP-0002-T04: audit-core/platform must bind exact
sender `approval-engine`, tenant `tenant:platform`, explicit redact policy,
the already delivered protected credential/native custody (2026-09-11),
authenticated ingest and all four heartbeat class registrations.
Synthetic native accepted/duplicate, read-refusal and independent archive
readback already passed in the platform receipts
`docs/evidence/2026-09-11-factory-native-producers.json` and
`docs/evidence/2026-09-11-factory-native-readback.json`; these do not prove
deployed service or lifecycle transaction emission. Remaining acceptance
requires service admission, actual lifecycle drain and bearer revocation,
same-window drained-versus-accepted reconciliation, startup heartbeat and
missing-class/lag findings. Existing AUDIT-WP-0009 detection code is reused;
neither a second observer nor new receiver APIs are required.
Orientation: Emergent Knowledge 0.2.5, digest
`9e186dbd6f2d5eb455bca24db4b03cd866c63c4e94660430dd15f2ca9856215f`,
start/evidence cards verified-files, orientation-only.
Validation: full owner suite 169 passed. Imported owner schema SHA-256
`6d52692eb1e4d1325e0d6062d95acded98beddaae5bcfe24c6f0e91f1b6be6ae`
and NetKingdom profile returned contract_valid/profile_assessed/conformant true
with zero findings for the authoritative inventory above. Reproduce from
net-kingdom with:
```bash
uv run tools/emission-cadence-profile/emission_cadence_profile.py \
--contract-schema ../info-tech-canon/infospace/schemas/emission-cadence.schema.yaml \
--load-bearing heartbeat \
--rare-load-bearing issuance --rare-load-bearing use \
--rare-load-bearing supersession --rare-load-bearing revocation \
../approval-engine/cadence.yaml
```
This supplies an owner-authored instance to NK-WP-0035; it does not accept the
proposed NetKingdom profile or claim receiver admission/observed cadence.