Answer flex-auth B3: the emitter is the section 4 source, not the archive

AUDIT-IN-0005. flex-auth produces the decision record, declares no §11
emission guarantee, and declined to take the reading that moves the
obligation to audit-core. audit-core declines it too, on its own authority:
class, cadence and detection surface are properties of emitting; audit-core
cannot detect non-production; the obligations already sit on each sender
registration; archive-as-source would make §11's check vacuous; and no
access-engine sender is registered at all.

Binds audit-core, does not rule §11 — gate-house still owns that, so
flex-auth's G2 stays open.

Reflexive half: audit-core's own chain-head attestation emission is now
declared in layer.yaml rather than only in docs/integrity.md prose, and
asserted against the CronJob and the contract by test.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

docs/section-4-source-of-evidence.md

@@ -0,0 +1,133 @@
+# Who is the §4 source of evidence
+
+`AUDIT-IN-0005`. Statute: `net-kingdom` security layer model §4, §9.6, §11, §17,
+companion profile `emission-cadence-security-profile_v0.1.md`.
+
+This document is **not derived**. It states audit-core's own boundary in
+audit-core's own voice, which is the only form §11 accepts for a declaration.
+
+## The question
+
+§11 requires every repository catalogued in §4 **as a source of evidence** to
+declare an emission guarantee — class, cadence, and the detection surface the
+governing cadence profile requires — in its machine-readable layer declaration,
+and says a source declaring none is not conforming.
+
+`access-engine` (the repository still answering to `flex-auth`) produces the
+decision record, declares no emission guarantee, and raised the ambiguity itself
+as B3 / G2: either it is a §4 source and is non-conformant today, or audit-core
+is the source and `access-engine` is merely the producer of an artifact
+audit-core is the source *of*. It declined to pick the second — the reading that
+favours it — and asked audit-core which side of the line audit-core holds.
+
+## The answer
+
+**audit-core is not the source of evidence for the decision record. The emitter
+is. For the decision record that emitter is `access-engine`.**
+
+audit-core holds the custody half and the detection surface. It does not hold,
+and will not accept, the emission guarantee for an event another repository
+produces.
+
+## Why, from audit-core's own record rather than from preference
+
+**1. All three declared things are properties of emitting, not of holding.**
+Class, cadence, and detection surface each describe the act of producing an
+event. audit-core can declare none of them for an event it does not produce: it
+cannot classify a stream it does not generate, cannot promise a rate or an
+interval for it, and — stated to gate-house in `AUDIT-IN-0003` against
+`GH-DEC-2026-014` limit 3, before this question existed — it **cannot detect
+non-production**. audit-core performs no retrieval; its egress permits Postgres
+and DNS only. A declaration audit-core made here would be a promise about
+behaviour audit-core cannot observe, which is the same defect as an event
+claiming an occurrence nobody watched.
+
+**2. It is already audit-core's stated doctrine, twice, in writing.**
+`AUDIT-IN-0001`: *"completeness at the boundary is the emitter's property, not
+the archive's"*, and emission atomicity is *"a requirement on approval-engine,
+not a task audit-core can discharge for it."* `AUDIT-WP-0009` lists *"emission
+atomicity at the source, which is the emitter's obligation (§9.6)"* among its
+non-goals. Taking the source role now would reverse a boundary audit-core has
+held against gate-house and against approval-engine, for the one repository that
+asked.
+
+**3. The estate's operative shape already assigns it that way.** Every
+obligation §11 names is carried on the **sender registration**, per source:
+`evidence_kind` in `deploy/senders-scope.{json,yaml}`, and `heartbeat_classes`
+per class rather than per source (`docs/stream-completeness.md`). Four sources
+are registered today — `user-engine`, `tenant-engine` (attributive, with its
+declared `completeness_trade`), `approval-engine` and `informed-decision` (both
+load-bearing) — and each carries its own classification because §11 and the
+cadence profile both say the classification is the **source's** published one and
+MUST NOT be inferred by the observer. Reading `access-engine` out of that set
+would make it the only producer in the estate whose emission obligation was held
+by the archive.
+
+**4. The archive-as-source reading makes §11 vacuous.** If custody conferred
+source status, every emission obligation in the estate would land on the single
+repository that can observe no emission, and no source could ever be
+non-conforming under §11. A rule that assigns an obligation the holder cannot
+discharge is the §9.1 defect §11 says it has now corrected four times; applying
+it here would make the fifth.
+
+**5. As a matter of fact, audit-core does not hold the record.** There is no
+registered sender named `access-engine` or `flex-auth`, no token, no ingress and
+no scope row. The decision record does not reach audit-core custody at all. A
+repository cannot be the source of evidence it has never received, and could not
+have been the source of it for the period in which the ambiguity stood.
+
+## What audit-core does owe, and it is not nothing
+
+The surface exists and is not a promise. §11 requires a **rare** load-bearing
+class to carry a heartbeat **and** reconciliation and forbids rate monitoring
+alone. audit-core built both, and built them in the shape a decision record
+needs:
+
+| Owed by the source | Owed by audit-core |
+| --- | --- |
+| The published class — load-bearing, and rare or volume | Accepting that classification as supplied and never inferring it |
+| The cadence, per class | `heartbeat_classes` on the registration; `POST /v1/events` class `audit-core.heartbeat` |
+| Reconciliation of its own counts | `GET /v1/reconciliation`, scoped to the caller's own sources, counts and never payloads |
+| — | `GET /v1/stream-findings`, and the `means` field on every finding |
+
+`access-engine`'s expectation — heartbeat plus reconciliation rather than rate,
+because a decision record is bursty and a quiet period is normal traffic — is
+correct and is the form already implemented. Registration goes through an intake
+(`AUDIT-IN-0002`, `AUDIT-IN-0003` are the worked examples) and needs a token
+lane, not a doctrine change.
+
+**The bound, stated so no conformance argument rests on more.** Heartbeat and
+reconciliation cover loss, outage, drain failure and accident. Neither covers a
+compromised source suppressing an event and its own count together. §16 placed
+the independent observer outside audit-core's scope. Nothing in this document
+may be read as audit-core detecting adversarial omission by a source.
+
+## What this ruling does not do
+
+It binds audit-core. It does not rule §11.
+
+§11 is `net-kingdom` canon authored by `gate-house`, and whether `access-engine`
+is a §4 source is on gate-house's list along with five other §11 questions
+(custodian survey, `the-custodian/docs/assessments/2026-09-21-layer-declaration-boundaries.md`,
+2026-09-21). audit-core has removed the only alternative reading by declining it
+on its own authority; the ruling itself is still gate-house's to make.
+
+So `access-engine`'s **G2 does not close on this document alone.** flex-auth
+holds it open until gate-house rules *and* audit-core confirms; this is the
+second of those two and not the first. audit-core's position is that with the
+alternative reading withdrawn by its holder, the remaining ruling has one
+defensible outcome — but saying so is a prediction about gate-house, not a
+substitute for it.
+
+## audit-core's own emission
+
+Asked which side of the line it holds, audit-core owes the same answer about
+itself. audit-core is catalogued in §4 as the Evidence engine, not as a source,
+and it emits no event into anyone else's custody. It does produce one artifact
+others rely on: the **chain-head attestation**. Its class, cadence and detection
+surface are now stated in `layer.yaml` under `emission_guarantee` rather than
+only in `docs/integrity.md`, because a guarantee legible only by following a
+document trail is the exact defect audit-core raised against flex-auth's
+declaration in §11 — and leaving it in prose while charging another repository
+with declaring theirs would be the flattering reading of an unruled boundary,
+which is the thing both repositories keep objecting to.