fix: repair chained imports and track blocked evidence dependencies

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046e-465c-7d43-8c4c-d10f0a1feadd

workplans/AUDIT-WP-0012-chained-sqlite-import.md

@@ -0,0 +1,65 @@
+---
+id: AUDIT-WP-0012
+type: workplan
+title: "Repair historical SQLite import into PostgreSQL custody"
+domain: infotech
+repo: audit-core
+status: finished
+owner: codex
+topic_slug: audit-evidence-dependencies
+created: "2026-10-04"
+updated: "2026-10-04"
+state_hub_workstream_id: "0d3658fe-bbe0-560c-8814-c367a93bb844"
+---
+
+# AUDIT-WP-0012 — Repair historical SQLite import into PostgreSQL custody
+
+Repair the open residual AUDIT-IN-0004. Source completion only: coordinating deployment of link-order append/verify workers is required before any historical production import; no deployment or native import is performed by this plan.
+
+## Preserve historical events in the existing destination chain
+
+```task
+id: AUDIT-WP-0012-T01
+status: done
+priority: high
+state_hub_task_id: "63d39a39-cae8-5773-a451-dfd78e78eac0"
+```
+
+AUDIT-IN-0004. Import takes a SQLite snapshot and the same PostgreSQL advisory lock as native append. PostgreSQL follows stored links instead of historical accepted_at order; existing links and exact timestamps remain untouched. No trigger is disabled. New migration 0007 adds indexes and side-table import receipts without editing released migrations. Conflicting historical evidence is reported, never overwritten. CLI exposes stable --source-id across source relocation.
+
+## Make dead-letter and finding replay idempotent
+
+```task
+id: AUDIT-WP-0012-T02
+status: done
+priority: high
+state_hub_task_id: "f310efd2-4b8c-5ee6-902f-4ad51a5ce5ec"
+```
+
+Transactional receipts identify source/row fingerprints. Replays skip dead letters, increment findings only by newly observed source counts, and report changed historic rows or decreasing counts as conflicts. Imported evidence and its receipt commit together.
+
+## Verify populated destinations, concurrency and complete PostgreSQL suite
+
+```task
+id: AUDIT-WP-0012-T03
+status: done
+priority: high
+state_hub_task_id: "2ef142c6-ba31-5cea-97c7-618af2f834cb"
+```
+
+Disposable local PostgreSQL at 127.0.0.1:55446, database audit_core; no production import. Final full suite: 322 passed, zero skips and no migration exclusions. New regression coverage: pre-existing attestation survives older imports, exact acceptance-time conflict, native append after import, concurrent native/import/replay, side-table replay and incremental counts, forks/orphans, and instance count boundaries. Rollback of events/side tables/receipts and stable source identity after file relocation also pass. Optional PyYAML/jsonschema checks were enabled in the repo venv; PYTHONPATH=/home/worsch/infospace-bench/src supplies the existing local canon dependency.
+
+
+## Review decision
+
+State Hub decision `8a896602-b6c6-4ecf-af81-2504e3e123dc` records the
+historical-time versus stored-link ordering rule and the owner evidence bounds.
+Validation command:
+
+```bash
+PYTHONPATH=/home/worsch/infospace-bench/src \
+AUDIT_CORE_TEST_DATABASE_URL=postgresql://postgres:test@127.0.0.1:55446/audit_core \
+.venv/bin/python -m pytest -q -rs
+```
+
+The database and password above are disposable local test fixtures.

workplans/AUDIT-WP-0013-cross-repo-sender-admission.md

@@ -0,0 +1,79 @@
+---
+id: AUDIT-WP-0013
+type: workplan
+title: "Complete flex-auth and Qonto sender admission"
+domain: infotech
+repo: audit-core
+status: blocked
+owner: codex
+topic_slug: audit-evidence-dependencies
+created: "2026-10-04"
+updated: "2026-10-04"
+state_hub_workstream_id: "9e400de2-6ba1-520e-9b25-94aa2470e528"
+---
+
+# AUDIT-WP-0013 — Complete flex-auth and Qonto sender admission
+
+All independent local receiver work in this plan is complete. Remaining tasks require named owner inputs or attended custody delivery; the workplan is blocked. Requirements are metadata-only and do not authorize deployment, credentials or bank traffic.
+
+## Review current owners and publish admission requirements
+
+```task
+id: AUDIT-WP-0013-T01
+status: done
+priority: high
+state_hub_task_id: "6f9505d8-81ea-5406-b693-0781b254b38d"
+```
+
+Reviewed AUDIT-IN-0006, FLEX-WP-0031, QONTO-WP-0006 and RAPP-QONTO-WP-0003. Accepted bounded custody/mapping commitments in docs/cross-repo-evidence-admission.md. Flex-auth T03 outbox is already done; transport registration must not wait on it or on downstream drain/observer completion. Exact prefixed heartbeat classes, source-owned rate thresholds and mixed Qonto class semantics are recorded.
+
+## Admit six flex-auth pin identities and verify custody
+
+```task
+id: AUDIT-WP-0013-T02
+status: wait
+priority: high
+blocking_reason: "flex-auth must return final per-pin cadence/scope/selector payloads; ops-warden routing catalog and railiance-platform attended seed/delivery are not supplied."
+blocked_on: message-from:flex-auth
+state_hub_task_id: "fff70081-0d6e-5e16-917a-c7cc3204ad53"
+```
+
+AUDIT-IN-0006 / FLEX-WP-0031-T02. Unblock with the six exact source registrations, explicit tenant/secret policies, emission_cadence including source-chosen allow thresholds, namespace/pod selectors, a governed usable catalog lane and attended custody receipts. The current audit-core-senders route is draft/unresolvable and describes an old ops-mason path; correct or replace that owner routing before attended mint. Then prepare scoped overlays and verify acceptance/retry/refusal/count/heartbeat/revocation behavior. may_read stays false. Requirements and owner split are in docs/cross-repo-evidence-admission.md; nothing is activated by this task.
+
+## Resolve the load-bearing failure-path declaration
+
+```task
+id: AUDIT-WP-0013-T03
+status: wait
+priority: high
+blocking_reason: "Gate House GH-WP-0004-T12 must supply the final decision and any canonical failure-path declaration shape."
+blocked_on: message-from:gate-house
+state_hub_task_id: "310e28d2-849d-549a-8c4b-d82c23ebad93"
+```
+
+Message 715cf1f2-55dd-4d2d-9b7b-c5dffa0181e5 is a reading, expressly not a ruling. Keep restrictive released_uncommitted classes non-atomic/non-conformant under current text. Do not treat attributive completeness_trade as an exception. This blocks conformance/exception declaration, not custody preparation in T02. Require the decision ID, applicable text/schema revision, classes, failure condition and detection obligations before implementing a new field.
+
+## Implement receiver process-instance accepted counts
+
+```task
+id: AUDIT-WP-0013-T04
+status: done
+priority: high
+state_hub_task_id: "cd7133db-7ce9-5e83-9914-b0e8ecf044a3"
+```
+
+Optional stream_instance_id on GET /v1/reconciliation selects exact retained details.data.stream_instance_id on both backends, preserving source/tenant permissions and bounded acceptance-time windows. Duplicate retries count once; empty/repeated filters are refused. Aggregate response is unchanged without the filter. API and both-backend regressions pass. This addresses one receiver gap for QONTO-WP-0006-T02, not runtime or observer acceptance.
+
+## Admit the Qonto collector and verify accepted-class mapping
+
+```task
+id: AUDIT-WP-0013-T05
+status: wait
+priority: high
+blocking_reason: "rapp-qonto must supply the actual collector binding, scope/selectors, mapping/lag rules and receiver receipts; qonto-assistant must approve classification and per-class cadence."
+blocked_on: message-from:rapp-qonto
+state_hub_task_id: "76b59808-abc3-5b8d-b31a-e3fb611f2cbe"
+```
+
+QONTO-WP-0006-T02. Audit-core owns admission and review of accepted mapping; rapp-qonto owns runtime delivery. Required inputs and proposed audit.allow/audit.deny/audit.heartbeat mapping are in docs/cross-repo-evidence-admission.md. Retain original stream instance, sequence and source counts. Approve deterministic retry IDs, heartbeat vouched-for class, authoritative tenant and acceptance-time/sequence-window comparison. Supply pinned collector/runtime artifacts, sanitized success/failure receipts and actual accepted records. Neither source stdout nor finished RAPP-QONTO-WP-0003 closes this gate. KG-WP-0005-T03 observer acceptance follows sender proof, never precedes it.
+

workplans/AUDIT-WP-0014-execution-attribution-receipt.md

@@ -0,0 +1,42 @@
+---
+id: AUDIT-WP-0014
+type: workplan
+title: "Validate canonical execution-attribution receipts on ingest"
+domain: infotech
+repo: audit-core
+status: blocked
+owner: codex
+topic_slug: audit-evidence-dependencies
+created: "2026-10-04"
+updated: "2026-10-04"
+state_hub_workstream_id: "687311f9-8830-5aac-b541-0c4f0413c9e6"
+---
+
+# AUDIT-WP-0014 — Validate canonical execution-attribution receipts on ingest
+
+The owner field list is a proposal and its schema is not supplied. Local contract review is complete; implementation cannot proceed honestly until the canonical owner and emitter return the requirements named below.
+
+## Establish the holder and emitter boundary
+
+```task
+id: AUDIT-WP-0014-T01
+status: done
+priority: high
+state_hub_task_id: "67ea59cb-b74b-5792-bc11-cdd30dfaf25b"
+```
+
+NK-WP-0040-T02 / message 48eb1101-a577-40c0-bbaa-39df02198155. Audit-core accepts evidence custody; Railiance is the proposed emitter and must confirm its exact source/component. NetKingdom owns the canonical schema and validator. Published field/unknown/absence/envelope requirements in docs/cross-repo-evidence-admission.md. Audit-core does not validate authorization truth or reconstruct an unknown actor chain.
+
+## Implement and test canonical receipt validation
+
+```task
+id: AUDIT-WP-0014-T02
+status: wait
+priority: high
+blocking_reason: "NetKingdom NK-WP-0040-T02 must return the versioned receipt schema, validator and fixtures; Railiance must confirm its emitting source and wire binding."
+blocked_on: message-from:net-kingdom
+state_hub_task_id: "33efb421-8dd7-5311-8447-9d6ca00992ba"
+```
+
+Return artifact paths/digests, unknown/optional semantics and positive/negative fixtures covering every proposed receipt field. Railiance returns source/type, run-id/idempotency binding, scope, classification/cadence and custody policies. Then enforce canonical data validation and tenant equality before acceptance; test malformed content, secret withholding, duplicate/conflict and unchanged unknowns. Generic JSON storage is not canonical receipt validation. No local substitute schema or default actor is fabricated.
+

workplans/AUDIT-WP-0015-independent-evidence-returns.md

@@ -0,0 +1,44 @@
+---
+id: AUDIT-WP-0015
+type: workplan
+title: "Obtain independent chain-head and refreshed tenancy evidence"
+domain: infotech
+repo: audit-core
+status: blocked
+owner: codex
+topic_slug: audit-evidence-dependencies
+created: "2026-10-04"
+updated: "2026-10-04"
+state_hub_workstream_id: "ad0685fd-77cc-5415-afae-87ea7226b195"
+---
+
+# AUDIT-WP-0015 — Obtain independent chain-head and refreshed tenancy evidence
+
+Track unmet independent evidence returns without relabeling historically completed implementation tasks as incomplete. Both tasks require owner evidence beyond audit-core; no local implementation can substitute for it.
+
+## Obtain independent offsite chain-head readback
+
+```task
+id: AUDIT-WP-0015-T01
+status: wait
+priority: high
+blocking_reason: "resource-control and rapp-postgres must name a current chain-head custody owner/task and return offsite upload/readback receipts with cadence and failure handling."
+blocked_on: message-from:resource-control
+state_hub_task_id: "5fa2bfe4-df47-58a1-9240-80e2ad224617"
+```
+
+AUDIT-WP-0009-T12 proves in-cluster attestation only. Finished RESOURCE-WP-0002-T06 proves database logical-copy recovery, not a chain-head copy operation. Require the independent Nextcloud + age destination outside cluster/Barman domains, matching head digest/event/count/observed_at readback, cadence/freshness/failure owner and retrieval test. Requirements in docs/cross-repo-evidence-admission.md. Do not add Nextcloud credentials to audit-core or claim cluster-owner resilience before this return.
+
+## Record refreshed E2 and asm-t08 owner prerequisites
+
+```task
+id: AUDIT-WP-0015-T02
+status: wait
+priority: high
+blocking_reason: "access-engine must confirm a tenant-A flex-auth identity without tenant-B authority, or Whitehat must supply a separately approved future engagement; asm-t08 surface owner inputs remain missing."
+blocked_on: message-from:access-engine
+state_hub_task_id: "e8a9cd4f-0267-524a-8ddd-5e1cec33e3af"
+```
+
+WHITEHAT-WP-0006-T03 stays wait. Prior -01/-02/-03 engagements are terminal; Whitehat requested no run. The alternative confirmation is access-engine-owned. asm-t08 needs its surface owner to name component revision, identities, window and technique. Preserve historical AUDIT-WP-0008-T05 completion and exact whitehat-security commit 7b5bc1e444cf57ae5d9ba1dac0c0189c0833e278. No engagement is minted, live run approved or packet sent. Requirements are recorded in docs/cross-repo-evidence-admission.md.
+