audit-core/docs/cadence-registration.md

# Cadence registry admission — NK-WP-0035

## Prepared source, not live acceptance

The 2026-10-15 source frame is f=3600 seconds. Approval Engine declares
issuance, use, supersession and revocation heartbeats every f. Register each
class wait at 2f=7200; audit-core's existing 1.5 grace makes the effective
missing-heartbeat deadline 3f=10800. Class keys are the asserted class names,
not the action names approval.issuance etc. Retain write true/read false,
source approval-engine and tenant tenant:platform.

`audit_core.cadence_registration.prepare` takes the protected KV data object,
raw source declaration bytes and the reviewed nonsecret proposal. It validates
the exact declaration SHA256, source/class/interval/provenance agreement and
incumbent scope. It returns the proposed in-memory KV object and metadata-only
receipt. Only heartbeat_classes and emission_cadence may change. Every token,
rotation overlap, expiry, policy, sibling sender and other KV property remains
unchanged. Existing unexpected heartbeat classes refuse a destructive drop.
The entire candidate is parsed by the real receiver sender registry parser.

No registry values belong in operator terminals, agent outputs, local files,
Git or State Hub. Root's sanctioned contained platform owner process may call
this pure API. `scripts/register-approval-engine-cadence.py` is a silent
attended wrapper requiring the warden isolated HOME and non-root platform-admin
identity. It defaults to preflight and uses KV-v2 CAS plus exact readback with
--apply. It does not mint credentials, synchronize ESO or restart workloads.
Consult the current custody route before invoking any credential operation;
this helper does not create custody authority.

## Receiver artifact and database prerequisite

Read-only native metadata on 2026-10-15 found receiver Deployment UID
b85fe3d0-75c9-4e0d-8c34-c6f1df0881bb, ready replicas 1 and image
forgejo.coulomb.social/coulomb/audit-core@sha256:ec15f63d49226bfe507af2bc38ffbd5e83f549ba2c6d1ae7a338e7e053f34615.
That artifact has heartbeat_classes and stream findings, but does not contain
audit_core.emission_cadence or stream_instance_id filtering in either ingest
or PostgreSQL. Its database ledger reports migrations 0001-events through
0006-chain. Source adds additive 0007-import-receipts. Applying registry cadence
alone to that old image is not receiver cadence admission.

Release gates: verify backup and rollback position; build/test current committed
source and pin its immutable image; run the migration Job with the existing
migration lease (runtime cannot migrate); verify ledger 0007; update the receiver
image without widening selectors/credentials; wait readyz and native feature
proof. Then the protected metadata CAS, exact ESO readback and receiver reload
must agree on the admitted declaration and class waits. Own-source counts,
wrong-scope refusals and actual heartbeat findings need native receipts.
No absence-of-finding claim proves completeness or adversarial omission.

## Qonto receiver mapping

rapp-qonto owns the collector, qonto-assistant owns declaration/classification,
and King's Guard owns independent observation. Proposed sender
rapp-qonto-collector permits source qonto-assistant, tenant tenant:friendly:binky,
subject qonto-assistant.audit, write true/read false, explicit redact policy.
Qonto source ownership must confirm that exact tenant binding. The mixed
sender is load-bearing; allow remains attributive in the per-class source
inventory. Stable original instance/sequence drives one retry-safe event ID.
Allow and deny retain their class; audit.heartbeat maps one-to-one to
audit-core.heartbeat, retains event_class audit.heartbeat, and asserts
`data.class=audit.deny`. It does not assert quiet allow activity.

`deploy/qonto-collector-ingress.yaml` is prepared separately from the general
network policies. It admits only namespace rapp-qonto AND pod label
app.kubernetes.io/name=rapp-qonto-audit-collector to receiver port8080.
The endpoint is http://audit-core.audit-core.svc.cluster.local:8080.
Sender admission and collector egress remain independently required. No bank
credential or bank API operation is required. Retain sequence, instance,
source counters/window boundaries and receiver acceptance-time boundaries;
compare only after the explicitly bounded drain lag. Per-instance filtering
isolates instances but does not detect gaps on its own.

AUDIT-WP-0013-T05 and NK-WP-0035 remain open until actual accepted records,
duplicate/refusal/reconciliation receipts and independent observer evidence
are available. Local tests and this prepared ingress are not those receipts.

## Native registration follow-up — 2026-10-15

The initial prepared/source and old-artifact observations above are historical.
Current b479801b (source5227fb1) passed its native capability gate; migration0007
completed. The guarded protected registry metadata update15→16, ESO projection
and receiver reload succeeded. Existing Approval credentials/scope and sibling
senders were preserved. Approval cadence and four waits7200 are now loaded;
Qonto collector native heartbeat/deny admission and own counts/refusals passed.
Local metadata evidence is in `docs/evidence/2026-10-15-cadence-admission/`.
These receipts do not claim independent operational acceptance, four fresh
Approval heartbeat observations or an actual hourly periodic Qonto observation.