audit-core/docs/cross-repo-evidence-admission.md

Cross-repo evidence admission requirements

Reviewed 2026-10-04 against audit-core source, intakes, inbox and owner files. Work: AUDIT-WP-0013 (senders), AUDIT-WP-0014 (execution receipts), and AUDIT-WP-0015 (independent evidence). These are source and metadata commitments; activation requires the relevant owner delivery and approved live change.

Flex-auth decision records — AUDIT-WP-0013-T02/T03

Owner file: access-engine/workplans/FLEX-WP-0031-decision-record-emission.md, reviewed at 257a83e997d7d30d3ace2b4524fab47cdfb7a6de. T03's durable outbox is done. Do not keep registration waiting on an outbox that already exists. Audit-core accepts custody admission per AUDIT-IN-0006; it does not decide how authorization effects are released.

Flex-auth must supply six final non-secret registration payloads and exact namespace/pod ingress selectors: ops-warden, tenant-engine, user-engine, secrets-engine, informed-decision-t03 and informed-decision-sitting. Each identity permits its exact flex-auth.<pin> source, write true/read false, tenants: ["*"] with the existing deny-before-tenant-creation justification, load-bearing and explicitly selected secret_policy: redact in the protected registry. No wildcard source match and no credential in the payload.

The emitter actually uses flex-auth.decision.<effect> (ClassPrefix in internal/emission/outbox.go). Final heartbeat keys must therefore be flex-auth.decision.deny, .redact, .not_applicable, .audit_only, each at 86400 seconds; shorthand effect names would monitor the wrong stored class. Heartbeat wire type is audit-core.heartbeat, with data.class set to the exact vouched-for class, independent non-empty correlation/id and offset-aware occurred_at. Each per-pin canonical emission_cadence must name the exact source and classes; flex-auth supplies allow's expected rate, window and threshold. Audit-core will not choose them for the source. Counts compare committed outbox entries, not all released decisions, by identical class/window.

The remaining custody owner is railiance-platform; ops-warden must supply a usable sender-mint routing entry. The current audit-core-senders entry exists but is draft, unresolvable and non-executable, names ops-mason, and describes an old in-cluster generation path; it is not the reviewed attended per-pin mint lane. Correct/promote the existing routing record or return a concrete owner lane, without creating a second competing registry. Use warden route before any credential request. An attended seed/delivery needs the founder's terminal and per-change go. Then audit-core reviews the payloads, prepares exact scope/ingress, and verifies accepted/duplicate writes, wrong source/tenant/read refusals, reconciliation, per-class missing heartbeats and formerly-valid bearer revocation. Source and owner revisions plus sanitized receipts are required.

Gate House GH-WP-0004-T12 owes the final decision for FLEX-DEC-2026-018. Message 715cf1f2-55dd-4d2d-9b7b-c5dffa0181e5 is explicitly a reading, not that decision: current text admits no load-bearing failure-path exception. Audit-core retains the non-atomic/non-conformant description for the restrictive classes released uncommitted. It will not repurpose attributive completeness_trade, add a permissive schema field ahead of the ruling, or claim atomicity. The final ruling blocks an exception/conformance declaration; it does not block preparing transport custody for honestly described evidence.

Qonto collector mapping — AUDIT-WP-0013-T04/T05

Accepted bounded receiver admission/mapping commitment for QONTO-WP-0006-T02. Qonto source reviewed at bf8a9ede6704523d4744d63bf481ca8b195d86f4. rapp-qonto owns the collector runtime; its finished RAPP-QONTO-WP-0003 is historical rollout evidence, not current collector acceptance. qonto-assistant owns the source declaration, class inventory, scope and process counters.

Source class	Proposed receiver type	Required preserved metadata
audit.allow	audit.allow	stream_id, stream_instance_id, stream_sequence, event_class and sanitized identity/egress context
audit.deny	audit.deny	same metadata; rare load-bearing, no expected-rate monitor
audit.heartbeat	audit-core.heartbeat	original event_class audit.heartbeat, timestamp/reason, instance and sequence, both source/window transition counts and window bounds

The adapter must supply every field of docs/event-envelope.md. Stable event id and Idempotency-Key must derive deterministically from the original instance and sequence so retries cannot mint new accepted records. Tenant and subject must come from an owner-approved binding, never inferred from a pod name or a convenience tenant. Preserve the original heartbeat event_class in data; do not rename Qonto's emitted class in its documentation.

A heartbeat can vouch for the quiet deny class through data.class=audit.deny. Its assertion is no deny transitions in the window, not proof that there were no allow transitions. qonto-assistant must approve that mapping and the exact per-class heartbeat registration with its canonical declaration and actual configured interval (default 86400). If another vouched-for class is needed, review fan-out and sequence/count accounting explicitly. Sender-level evidence_kind has one value: use the source owner's explicit load-bearing admission for this mixed stream, retaining attributive allow and load-bearing deny/heartbeat in the per-class canonical inventory. No blanket atomicity or completeness claim follows from admission.

Audit-core now implements GET /v1/reconciliation's optional stream_instance_id, selecting exact stored data.stream_instance_id within an authorized source/tenant and acceptance-time window. Duplicates count once; restarts never share counts accidentally. This is source-tested and requires a reviewed receiver release before live use. It does not turn source-time windows into acceptance-time windows. The collector/observer must define bounded lag, watermark/sequence boundaries and the comparable accepted-count derivation; it must distinguish late arrival from lost evidence. Sender own counts are available with read false. Independent kings-guard archive/sequence inspection needs its separately scoped read identity/feed, not a writer upgraded to read all tenants. No observer access scope is invented here.

Unblock inputs from rapp-qonto: collector source/image/config/Deployment pins, metadata-only sample envelopes, exact namespace/pod selectors, authoritative tenant binding, stable instance/restart/scale-to-zero semantics, retry/drop and lag behavior, redacted success/failure receipts and actual accepted receiver records. From qonto-assistant: reviewed mapping and per-class cadence, classification, retention/access/export/secret policy. Audit-core then prepares registration and checks acceptance, retries, retained instance/sequence, wrong-scope refusals and accepted-count derivation. King's Guard KG-WP-0005-T03 subsequently owns independent missing-heartbeat, sequence-gap and count-divergence acceptance. T02's sender proof never waits on Qonto T03 observer acceptance. No bank keys or bank API traffic are needed for these receipts.

Execution-attribution receipts — AUDIT-WP-0014

Proposal reviewed in net-kingdom/canon/standards/playbook-capability-contract_v0.2.md at 45a189a39167eef62709df0e857309f7ddc59029 (NK-WP-0040-T02). Audit-core accepts the evidence-holder role; Railiance is the proposed emitter and must confirm its exact emitting component and sender source. NetKingdom owns the canonical receipt schema and validator. Audit-core checks shape and credential scope, stores the event and chains it. Custody does not authenticate the historical actor chain or decide whether decision_refs authorize execution.

Before implementation, NetKingdom must return a versioned schema, artifact path/digest, unknown/absent semantics and positive/negative fixtures. All listed fields must be represented: initiator issuer/subject, optional delegation, executing workload, runtime principal, tenant, environment, run id, source commit, artifact digest, target, action, decision refs and time interval with clock source and optional established precision bound. Unknown attribution stays explicit unknown; delegation is absent when none; a time bound is absent when not established. No bearer or role response may be embedded.

Railiance must supply the exact wire event class and sender, authoritative scope, stable retry/id binding to run_id, classification, emission guarantee, retention/access/export and secret policy, plus emitter revision and metadata fixtures. Audit-core will wrap the receipt in its existing eight-field envelope, validate the canonical data schema before accept, enforce declared tenant/source, refuse malformed/secret content, retain original unknowns, and prove duplicate and conflict behavior. Cross-check receipt tenant with envelope tenant; require ordered offset-aware start/end if that is the canonical rule. No independent local receipt schema is shipped ahead of the owner schema, and generic JSON acceptance is not advertised as receipt-schema validation.

NK-WP-0056 names a new emitter, the NetKingdom bounded executor in sso. Its mapping (one receipt per run plus a started event, correlated by run_id) is in docs/bounded-executor-receipts.md (AUDIT-WP-0018).

Independent chain-head custody — AUDIT-WP-0015-T01

RESOURCE-WP-0002-T06 is done for encrypted logical database copies. That terminal task is not an unfinished chain-head copy commitment. The 2026-09-15 AUDIT-WP-0009-T12 receipt proves the in-cluster attestor only. resource-control and rapp-postgres must name the current offsite operator/owner record, return a destination outside cluster and Barman failure domains on the existing Nextcloud + age lane, and supply metadata-only upload and independent readback receipts for the same chain-head digest, event id/count and observed_at. State cadence, freshness/failure handling, access separation and retrieval test. No Nextcloud credential belongs in audit-core. Without this return, the control remains a database-owner boundary and carries no cluster-owner survival claim.

Refreshed E2 and asm-t08 — AUDIT-WP-0015-T02

Whitehat commit 7b5bc1e444cf57ae5d9ba1dac0c0189c0833e278 and message 81bebdd8-5ca7-47b3-aafe-1d00ff8be122 leave WHITEHAT-WP-0006-T03 wait. The 2026-08-22 E2 run is historical and its -01/-02/-03 engagement ids are terminal. Whitehat is not requesting a run. A future run needs a distinct engagement, plane admission and rules-of-engagement approvals; audit-core creates none of those during this review. The alternative is access-engine's confirmation of a flex-auth tenant-A identity with no tenant-B authority. asm-t08's surface owner owes component revision, identities, window and technique. These remain owner inputs; no field or authorization is fabricated. Original AUDIT-WP-0008-T05 remains done for its historical accepted scope.

Qonto native admission update — 2026-10-15

AUDIT-WP-0013-T05 is complete for its bounded sender-native admission. The source frame is now3600 seconds, receiver wait7200 and effective deadline10800. Sender rapp-qonto-collector/source qonto-assistant/tenant tenant:friendly:binky remains write-only, explicit redact, with canonical mixed per-class classification. The compatible b479801b receiver release and migration0007 are live. Protected registry CAS15→16 preserved other senders and all incumbent credentials; ESO projection and receiver runtime configuration match. Actual same-instance heartbeat/deny delivery, duplicates, scoped reconciliation and wrong-source, wrong-tenant, archive-read and invalid-bearer refusals passed. Durable first202 receipts persisted across collector replacement. See the local docs/evidence/2026-10-15-cadence-admission/index.json and workplan acceptance note for exact limitations. Native allow delivery is not claimed. Independent KG operational acceptance and real elapsed hourly observation remain separate.