coulomb/audit-core
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Define retained PDP audit admission and complete-ledger reconciliation
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
tegwick 2026-10-16 19:25:03 +02:00
parent 2e97f37c01
commit 64509d2c40
3 changed files with 296 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

23
workplans/AUDIT-WP-0013-cross-repo-sender-admission.md
View file

@ -131,3 +131,26 @@ not independent receiver readback. Real elapsed hourly observation, independent
active-instance/class-silence/sequence/count/lag assessment and Approval lifecycle
acceptance remain with NK-WP-0035/KG-WP-0005. Source-global receiver findings must
not misclassify intentional Qonto scale-to-zero as an active-instance omission.
### First protected pin admission preparation — 2026-10-16
T02 remains wait. Prepared docs/flex-auth-secrets-engine-admission.md against
Access0a05383195213e7eaacd08388ce1d7892ce756df and Audit2e97f37. Existing wire
contracts need no adapter. Seven local tests cover all five decision classes,
retry/conflict, independent fixture readback, writer-read and wrong-scope refusal,
half-open acceptance-time accounting and rare-class silence. This does not grant
or admit a sender. Per-pin source/cadence/policy/selectors, usable attended custody
route, source deployment/PVC and independent native readback remain owner gates.
Generic source cadence remains daily and cannot stand in for admitted hourly
runtime. Source outbox sequence is not on the wire; exact event-ID/accepted_at
comparison is the bounded readback method, not cumulative-time-window equality.
Cross-owner follow-up: Access confirms auditDelivery remains disabled in the
initial signer slice. The packet now requires independently retained complete
producer JSONL with contiguous sequence/high-water and lifetime identity, not a
selected-ID list. Existing exact-ID reads plus all-class accepted-time count
comparison support bounded full-ledger reconciliation; correlation search is
capped and cannot serve as complete export. Operational repeated ledger custody,
per-pin source cadence/runtime adoption and independent observation still wait.
The canonical sibling-owner fixture check passed1, resolving the isolated
checkout's expected skip without modifying foreign source.