Derive heartbeat cadence from the shared coordination frame

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2

docs/audit-source-registration.md

@@ -35,15 +35,18 @@ whichever class happens to be busy and says nothing about the quiet one — here
 that is `revocation`, whose silence is the only silence that matters. Requested
 `heartbeat_classes`, all four at the same bound:
 
-| Class | Longest gap that is not yet a finding |
+| Class | Registered wait before receiver grace |
 | --- | --- |
-| `issuance` | 172800s (48h) |
-| `use` | 172800s (48h) |
-| `supersession` | 172800s (48h) |
-| `revocation` | 172800s (48h) |
+| `issuance` | 2f = 7200s (2h) |
+| `use` | 2f = 7200s (2h) |
+| `supersession` | 2f = 7200s (2h) |
+| `revocation` | 2f = 7200s (2h) |
 
-Twice the deployed `--heartbeat-seconds` default of 86400, so one missed cycle
-is not a finding and two consecutive ones are. The engine emits all four in a
+These are registered base waits, not the effective alert threshold. Founder
+coordination-frame decision 2026-10-15 sets f=3600s. The prepared emitter
+interval is f; the receiver wait is 2f=7200s, and Audit Core's existing 1.5
+grace gives an effective deadline of 3f=10800s. This source request is not a
+live registry receipt or proof that deployment has changed pace. The engine emits all four in a
 single transaction: a partial emission would report some classes healthy and
 others stalled, which is a worse signal than none.
 
@@ -83,3 +86,12 @@ owners and bounds; this registration does not claim their completion.
 First provisioning still requires the platform-owned custody record linking
 the receiver's protected sender registry and this mounted credential. No
 credential value belongs in this document, Git, Hub or a rollout receipt.
+
+
+Current timing values derive from coordination-engine/config/coordination-frame.json
+through net-kingdom/tools/coordination-frame/render.py. The generated declaration,
+consumer constants and deployment pod annotation carry its SHA-256. Existing
+credential scope and the native September 15 bearer-revocation proof are
+retained; do not repeat that unchanged proof as if it were missing. Actual
+lifecycle reconciliation, class registration, lag findings and operational
+observer readback remain APPROVAL-WP-0002-T04.

docs/emission-cadence.md

@@ -21,10 +21,10 @@ becomes a missing positive rather than a quiet month.
 | Field | Value |
 | --- | --- |
 | Class | `heartbeat` |
-| Interval | 24 hours (SHOULD also be emittable on demand) |
+| Interval | f = 1 hour; SHOULD also be emittable on demand |
 | Assertion | `nothing-to-report` |
 | Counts | `{issuance, use, supersession, revocation}` of committed outbox rows |
-| Missing heartbeat | **finding** after the requested 172800s receiver bound; registration pending |
+| Missing heartbeat | **finding** after effective 3f = 3h (registration 2f = 2h plus receiver 1.5 grace); admission pending |
 
 ### Reconciliation
 
@@ -48,7 +48,7 @@ case §9.6 names.
 
 ## What is a finding
 
-- No per-class heartbeat arrives beyond the requested 48h receiver bound (24h emission interval).
+- No per-class heartbeat arrives beyond the effective 3f deadline (f emission interval).
 - `audit-core` count for a class is less than this engine's drained count
   for that class.
 - Outbox depth or age exceeds the lag bound in `cadence.yaml` (drain stuck).
@@ -143,3 +143,19 @@ snapshot proves completeness or resistance to source compromise.
 This implements T04's missing bounded source computation. Receiver registration,
 observed lag/findings and native reconciliation remain blocked owner acceptance;
 no existing live image is promoted by this change.
+
+
+## Configurable coordination frame — 2026-10-15
+
+The timing paragraphs in the dated October 3 migration section describe its
+historical daily defaults. Current source defaults and the prepared manifest
+are derived from coordination-engine/config/coordination-frame.json, initially
+f=3600s by founder decision. The generated approval_engine/coordination.py and
+cadence.yaml retain the config digest; CLI and direct OutboxWorker defaults
+use FRAME_SECONDS. The deployment argument explicitly supplies the same value
+and its pod annotation retains the frame digest. Runtime applies remain under
+the owner change gate; no hourly live cadence is claimed by this source edit.
+
+Class mappings, ownership, atomic outbox behavior and count-window accounting
+are unchanged. A different frame is regenerated for emitter and observer
+settings together using net-kingdom/tools/coordination-frame/render.py.

docs/production-dependencies.md

@@ -6,7 +6,7 @@ the workplan remains `blocked` after completing reachable source work.
 | Task | Owner return required | Evidence that clears the wait |
 | --- | --- | --- |
 | T01 — authenticated approver evidence | key-cape and informed-decision; founder for release rollout | Exact deployed issuer revision and client/profile receipt for requester and human paths; human sub/type, tenant/source, resource audience, scopes and assurance captured as non-secret facts and correlated with a stored human-control entry. Promote scanned schema-v6 image under per-change approval, back up/migrate once, then verify native entry and issuance/use provenance. No tokens or secrets in receipts. |
-| T04 — delivery and reconciliation | audit-core, with railiance-platform for deployed sender/custody acceptance | Accept current cadence.yaml inventory for source approval-engine and tenant tenant:platform, explicit redact policy and four transition heartbeat classes at the requested 172800s bound. Return actual lifecycle event ids/drain acknowledgment and independent accepted counts for an agreed bounded comparison, accounting for occurrence versus receiver acceptance time, delayed delivery, duplicate acknowledgments and boundary crossings; source pending rows remain lag. Prove startup beats, missing-class and lag findings (depth 100 / age 3600s), and scoped sender bearer revocation. |
+| T04 — delivery and reconciliation | audit-core, with railiance-platform for deployed sender/custody acceptance | Accept current cadence.yaml inventory for source approval-engine and tenant tenant:platform, explicit redact policy and four transition heartbeat classes at the frame-derived 2f=7200s registered wait (effective 3f=10800s after receiver grace). Return actual lifecycle event ids/drain acknowledgment and independent accepted counts for an agreed bounded comparison, accounting for occurrence versus receiver acceptance time, delayed delivery, duplicate acknowledgments and boundary crossings; source pending rows remain lag. Prove startup beats, missing-class and lag findings (depth 100 / age 3600s), and retain the delivered September 15 scoped sender bearer-revocation receipt. |
 | T05 — live PEP consumption | secrets-engine, with informed-decision for the act-specific human review and access-engine for decision binding | Name the served PEP route/workload, immutable component revision, engine image/endpoint, authenticated caller identities and exact binding. Prove claim-before-decision and CAS consume after ALLOW before protected side effect; same-digest retry, different-digest conflict, spent-on-failure, revoked/expired/superseded/wrong-binding/unavailable denial with no protected callback. Preserve the native approval and decision digests, declared human_control where required, and consumer-owned side-effect/refusal evidence. |
 
 For live whitehat T-06 only, T05's named surface must additionally be covered by
@@ -76,3 +76,11 @@ population and reconcile lag/duplicate/boundary cases; matching since/until
 strings against occurrence counts is insufficient. Existing owner task bindings
 remain key-cape (T01), audit-core (T04) and secrets-engine (T05). No new owner
 receipt or named live T-06 surface arrived since the preceding review.
+
+
+2026-10-15 timing follow-up: founder selected shared coordination f=1h,
+replacing a fixed day for this adoption. Generated source/config bindings are
+prepared, not deployed. Canonical base is coordination-engine/config/coordination-frame.json;
+NetKingdom retains regeneration and drift checks. Lifecycle drain/count-window,
+registry admission and independent observation remain open. No credential,
+JWT/approval validity, issuer scope or production image pin is changed.