audit-core/docs/cross-repo-evidence-admission.md

# Cross-repo evidence admission requirements

Reviewed 2026-10-04 against audit-core source, intakes, inbox and owner files.
Work: AUDIT-WP-0013 (senders), AUDIT-WP-0014 (execution receipts), and
AUDIT-WP-0015 (independent evidence). These are source and metadata commitments;
activation requires the relevant owner delivery and approved live change.

## Flex-auth decision records — AUDIT-WP-0013-T02/T03

Owner file: access-engine/workplans/FLEX-WP-0031-decision-record-emission.md,
reviewed at `257a83e997d7d30d3ace2b4524fab47cdfb7a6de`. T03's durable outbox
is done. Do not keep registration waiting on an outbox that already exists.
Audit-core accepts custody admission per AUDIT-IN-0006; it does not decide how
authorization effects are released.

Flex-auth must supply six final non-secret registration payloads and exact
namespace/pod ingress selectors: ops-warden, tenant-engine, user-engine,
secrets-engine, informed-decision-t03 and informed-decision-sitting. Each
identity permits its exact `flex-auth.<pin>` source, write true/read false,
`tenants: ["*"]` with the existing deny-before-tenant-creation justification,
load-bearing and explicitly selected `secret_policy: redact` in the protected
registry. No wildcard source match and no credential in the payload.

The emitter actually uses `flex-auth.decision.<effect>` (ClassPrefix in
internal/emission/outbox.go). Final heartbeat keys must therefore be
`flex-auth.decision.deny`, `.redact`, `.not_applicable`, `.audit_only`, each at
86400 seconds; shorthand effect names would monitor the wrong stored class.
Heartbeat wire type is `audit-core.heartbeat`, with `data.class` set to the
exact vouched-for class, independent non-empty correlation/id and offset-aware
occurred_at. Each per-pin canonical `emission_cadence` must name the exact
source and classes; flex-auth supplies allow's expected rate, window and
threshold. Audit-core will not choose them for the source. Counts compare
committed outbox entries, not all released decisions, by identical class/window.

The remaining custody owner is railiance-platform; ops-warden must supply a usable sender-mint routing entry.
The current audit-core-senders entry exists but is draft, unresolvable and
non-executable, names ops-mason, and describes an old in-cluster generation
path; it is not the reviewed attended per-pin mint lane. Correct/promote the
existing routing record or return a concrete owner lane, without creating a
second competing registry. Use `warden route` before any credential
request. An attended seed/delivery needs the founder's terminal and per-change
go. Then audit-core reviews the payloads, prepares exact scope/ingress,
and verifies accepted/duplicate writes, wrong source/tenant/read refusals,
reconciliation, per-class missing heartbeats and formerly-valid bearer
revocation. Source and owner revisions plus sanitized receipts are required.

Gate House GH-WP-0004-T12 owes the final decision for FLEX-DEC-2026-018.
Message `715cf1f2-55dd-4d2d-9b7b-c5dffa0181e5` is explicitly a reading, not
that decision: current text admits no load-bearing failure-path exception.
Audit-core retains the non-atomic/non-conformant description for the restrictive
classes released uncommitted. It will not repurpose attributive
`completeness_trade`, add a permissive schema field ahead of the ruling, or
claim atomicity. The final ruling blocks an exception/conformance declaration;
it does not block preparing transport custody for honestly described evidence.

## Qonto collector mapping — AUDIT-WP-0013-T04/T05

Accepted bounded receiver admission/mapping commitment for QONTO-WP-0006-T02.
Qonto source reviewed at `bf8a9ede6704523d4744d63bf481ca8b195d86f4`.
rapp-qonto owns the collector runtime; its finished RAPP-QONTO-WP-0003 is
historical rollout evidence, not current collector acceptance. qonto-assistant
owns the source declaration, class inventory, scope and process counters.

| Source class | Proposed receiver type | Required preserved metadata |
| --- | --- | --- |
| audit.allow | audit.allow | stream_id, stream_instance_id, stream_sequence, event_class and sanitized identity/egress context |
| audit.deny | audit.deny | same metadata; rare load-bearing, no expected-rate monitor |
| audit.heartbeat | audit-core.heartbeat | original event_class audit.heartbeat, timestamp/reason, instance and sequence, both source/window transition counts and window bounds |

The adapter must supply every field of docs/event-envelope.md. Stable event id
and Idempotency-Key must derive deterministically from the original instance
and sequence so retries cannot mint new accepted records. Tenant and subject
must come from an owner-approved binding, never inferred from a pod name or a
convenience tenant. Preserve the original heartbeat event_class in data; do
not rename Qonto's emitted class in its documentation.

A heartbeat can vouch for the quiet deny class through `data.class=audit.deny`.
Its assertion is no deny transitions in the window, not proof that there were
no allow transitions. qonto-assistant must approve that mapping and the exact
per-class heartbeat registration with its canonical declaration and actual
configured interval (default 86400). If another vouched-for class is needed,
review fan-out and sequence/count accounting explicitly. Sender-level
`evidence_kind` has one value: use the source owner's explicit load-bearing
admission for this mixed stream, retaining attributive allow and load-bearing
deny/heartbeat in the per-class canonical inventory. No blanket atomicity or
completeness claim follows from admission.

Audit-core now implements `GET /v1/reconciliation`'s optional
`stream_instance_id`, selecting exact stored `data.stream_instance_id` within
an authorized source/tenant and acceptance-time window. Duplicates count once;
restarts never share counts accidentally. This is source-tested and requires a
reviewed receiver release before live use. It does not turn source-time windows
into acceptance-time windows. The collector/observer must define bounded lag,
watermark/sequence boundaries and the comparable accepted-count derivation;
it must distinguish late arrival from lost evidence. Sender own counts are
available with read false. Independent kings-guard archive/sequence inspection
needs its separately scoped read identity/feed, not a writer upgraded to read
all tenants. No observer access scope is invented here.

Unblock inputs from rapp-qonto: collector source/image/config/Deployment pins,
metadata-only sample envelopes, exact namespace/pod selectors, authoritative
tenant binding, stable instance/restart/scale-to-zero semantics, retry/drop and
lag behavior, redacted success/failure receipts and actual accepted receiver
records. From qonto-assistant: reviewed mapping and per-class cadence,
classification, retention/access/export/secret policy. Audit-core then prepares
registration and checks acceptance, retries, retained instance/sequence,
wrong-scope refusals and accepted-count derivation. King's Guard KG-WP-0005-T03
subsequently owns independent missing-heartbeat, sequence-gap and count-divergence
acceptance. T02's sender proof never waits on Qonto T03 observer acceptance.
No bank keys or bank API traffic are needed for these receipts.

## Execution-attribution receipts — AUDIT-WP-0014

Proposal reviewed in net-kingdom/canon/standards/playbook-capability-contract_v0.2.md
at `45a189a39167eef62709df0e857309f7ddc59029` (NK-WP-0040-T02).
Audit-core accepts the evidence-holder role; Railiance is the proposed emitter
and must confirm its exact emitting component and sender source. NetKingdom
owns the canonical receipt schema and validator. Audit-core checks shape and
credential scope, stores the event and chains it. Custody does not authenticate
the historical actor chain or decide whether decision_refs authorize execution.

Before implementation, NetKingdom must return a versioned schema, artifact
path/digest, unknown/absent semantics and positive/negative fixtures. All listed
fields must be represented: initiator issuer/subject, optional delegation,
executing workload, runtime principal, tenant, environment, run id, source
commit, artifact digest, target, action, decision refs and time interval with
clock source and optional established precision bound. Unknown attribution stays
explicit `unknown`; delegation is absent when none; a time bound is absent when
not established. No bearer or role response may be embedded.

Railiance must supply the exact wire event class and sender, authoritative
scope, stable retry/id binding to run_id, classification, emission guarantee,
retention/access/export and secret policy, plus emitter revision and metadata
fixtures. Audit-core will wrap the receipt in its existing eight-field envelope,
validate the canonical data schema before accept, enforce declared tenant/source,
refuse malformed/secret content, retain original unknowns, and prove duplicate
and conflict behavior. Cross-check receipt tenant with envelope tenant; require
ordered offset-aware start/end if that is the canonical rule. No independent
local receipt schema is shipped ahead of the owner schema, and generic JSON
acceptance is not advertised as receipt-schema validation.

NK-WP-0056 names a new emitter, the NetKingdom bounded executor in `sso`. Its
mapping (one receipt per run plus a `started` event, correlated by `run_id`) is in
`docs/bounded-executor-receipts.md` (AUDIT-WP-0018).

## Independent chain-head custody — AUDIT-WP-0015-T01

RESOURCE-WP-0002-T06 is done for encrypted logical database copies. That
terminal task is not an unfinished chain-head copy commitment. The 2026-09-15
AUDIT-WP-0009-T12 receipt proves the in-cluster attestor only.
resource-control and rapp-postgres must name the current offsite operator/owner
record, return a destination outside cluster and Barman failure domains on the
existing Nextcloud + age lane, and supply metadata-only upload and independent
readback receipts for the same chain-head digest, event id/count and observed_at.
State cadence, freshness/failure handling, access separation and retrieval test.
No Nextcloud credential belongs in audit-core. Without this return, the control
remains a database-owner boundary and carries no cluster-owner survival claim.

## Refreshed E2 and asm-t08 — AUDIT-WP-0015-T02

Whitehat commit `7b5bc1e444cf57ae5d9ba1dac0c0189c0833e278` and message
`81bebdd8-5ca7-47b3-aafe-1d00ff8be122` leave WHITEHAT-WP-0006-T03 wait.
The 2026-08-22 E2 run is historical and its -01/-02/-03 engagement ids are
terminal. Whitehat is not requesting a run. A future run needs a distinct
engagement, plane admission and rules-of-engagement approvals; audit-core
creates none of those during this review. The alternative is access-engine's
confirmation of a flex-auth tenant-A identity with no tenant-B authority.
asm-t08's surface owner owes component revision, identities, window and technique.
These remain owner inputs; no field or authorization is fabricated. Original
AUDIT-WP-0008-T05 remains done for its historical accepted scope.

## Qonto native admission update — 2026-10-15

AUDIT-WP-0013-T05 is complete for its bounded sender-native admission. The source
frame is now3600 seconds, receiver wait7200 and effective deadline10800. Sender
rapp-qonto-collector/source qonto-assistant/tenant tenant:friendly:binky remains
write-only, explicit redact, with canonical mixed per-class classification.
The compatible b479801b receiver release and migration0007 are live. Protected
registry CAS15→16 preserved other senders and all incumbent credentials; ESO
projection and receiver runtime configuration match. Actual same-instance
heartbeat/deny delivery, duplicates, scoped reconciliation and wrong-source,
wrong-tenant, archive-read and invalid-bearer refusals passed. Durable first202
receipts persisted across collector replacement. See the local
`docs/evidence/2026-10-15-cadence-admission/index.json` and workplan acceptance
note for exact limitations. Native allow delivery is not claimed. Independent
KG operational acceptance and real elapsed hourly observation remain separate.