audit-core/workplans/AUDIT-WP-0013-cross-repo-sender-admission.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	state_hub_workstream_id
AUDIT-WP-0013	workplan	Complete flex-auth and Qonto sender admission	infotech	audit-core	blocked	codex	audit-evidence-dependencies	2026-10-04	2026-10-15	9e400de2-6ba1-520e-9b25-94aa2470e528

AUDIT-WP-0013 — Complete flex-auth and Qonto sender admission

All independent local receiver work in this plan is complete. Remaining tasks require named owner inputs or attended custody delivery; the workplan is blocked. Requirements are metadata-only and do not authorize deployment, credentials or bank traffic.

Review current owners and publish admission requirements

id: AUDIT-WP-0013-T01
status: done
priority: high
state_hub_task_id: "6f9505d8-81ea-5406-b693-0781b254b38d"

Reviewed AUDIT-IN-0006, FLEX-WP-0031, QONTO-WP-0006 and RAPP-QONTO-WP-0003. Accepted bounded custody/mapping commitments in docs/cross-repo-evidence-admission.md. Flex-auth T03 outbox is already done; transport registration must not wait on it or on downstream drain/observer completion. Exact prefixed heartbeat classes, source-owned rate thresholds and mixed Qonto class semantics are recorded.

Admit six flex-auth pin identities and verify custody

id: AUDIT-WP-0013-T02
status: wait
priority: high
blocking_reason: "flex-auth must return final per-pin cadence/scope/selector payloads; ops-warden routing catalog and railiance-platform attended seed/delivery are not supplied."
blocked_on: message-from:flex-auth
state_hub_task_id: "fff70081-0d6e-5e16-917a-c7cc3204ad53"

AUDIT-IN-0006 / FLEX-WP-0031-T02. Unblock with the six exact source registrations, explicit tenant/secret policies, emission_cadence including source-chosen allow thresholds, namespace/pod selectors, a governed usable catalog lane and attended custody receipts. The current audit-core-senders route is draft/unresolvable and describes an old ops-mason path; correct or replace that owner routing before attended mint. Then prepare scoped overlays and verify acceptance/retry/refusal/count/heartbeat/revocation behavior. may_read stays false. Requirements and owner split are in docs/cross-repo-evidence-admission.md; nothing is activated by this task.

Resolve the load-bearing failure-path declaration

id: AUDIT-WP-0013-T03
status: done
priority: high
state_hub_task_id: "310e28d2-849d-549a-8c4b-d82c23ebad93"

Message 715cf1f2-55dd-4d2d-9b7b-c5dffa0181e5 is a reading, expressly not a ruling. Keep restrictive released_uncommitted classes non-atomic/non-conformant under current text. Do not treat attributive completeness_trade as an exception. This blocks conformance/exception declaration, not custody preparation in T02. Require the decision ID, applicable text/schema revision, classes, failure condition and detection obligations before implementing a new field.

Resolved 2026-10-10 by GH-DEC-2026-024 (gate-house@0192273, message 8b375579): the §9.6 failure-path release is refused. A load-bearing source gets no declared, detectable, direction-limited release, and §11 gets no declaration for one, so no new field is introduced. completeness_trade keeps its attributive-only meaning. That is already enforced: SenderIdentity rejects a completeness_trade on a load-bearing source (audit_core/senders.py, tests/test_senders.py::test_a_load_bearing_source_cannot_be_given_a_completeness_trade). A released_uncommitted class stays non-conformant. audit-core's evidence-source status is no (GH-DEC-2026-018, AUDIT-IN-0005). Registering the AUDIT-IN-0006 senders is still this repo's job, under T02/T05.

Implement receiver process-instance accepted counts

id: AUDIT-WP-0013-T04
status: done
priority: high
state_hub_task_id: "cd7133db-7ce9-5e83-9914-b0e8ecf044a3"

Optional stream_instance_id on GET /v1/reconciliation selects exact retained details.data.stream_instance_id on both backends, preserving source/tenant permissions and bounded acceptance-time windows. Duplicate retries count once; empty/repeated filters are refused. Aggregate response is unchanged without the filter. API and both-backend regressions pass. This addresses one receiver gap for QONTO-WP-0006-T02, not runtime or observer acceptance.

Admit the Qonto collector and verify accepted-class mapping

id: AUDIT-WP-0013-T05
status: wait
priority: high
blocking_reason: "rapp-qonto must supply the actual collector binding, scope/selectors, mapping/lag rules and receiver receipts; qonto-assistant must approve classification and per-class cadence."
blocked_on: message-from:rapp-qonto
state_hub_task_id: "76b59808-abc3-5b8d-b31a-e3fb611f2cbe"

QONTO-WP-0006-T02. Audit-core owns admission and review of accepted mapping; rapp-qonto owns runtime delivery. Required inputs and proposed audit.allow/audit.deny/audit.heartbeat mapping are in docs/cross-repo-evidence-admission.md. Retain original stream instance, sequence and source counts. Approve deterministic retry IDs, heartbeat vouched-for class, authoritative tenant and acceptance-time/sequence-window comparison. Supply pinned collector/runtime artifacts, sanitized success/failure receipts and actual accepted records. Neither source stdout nor finished RAPP-QONTO-WP-0003 closes this gate. KG-WP-0005-T03 observer acceptance follows sender proof, never precedes it.

NK-WP-0035 receiver readiness, 2026-10-15

Prepared credential-preserving Approval Engine cadence transformation and silent attended CAS wrapper; default f=3600, class waits7200, effective10800. Ten focused preservation/refusal/idempotence tests pass. Prepared exact Qonto collector ingress (namespace AND pod selector), contingent on source-owner tenant/mapping acceptance. Read-only native metadata proves deployed ec15f63d artifact lacks cadence module and process-instance filtering; database migration ledger is0006, source adds additive0007-import-receipts. Current-source receiver release/migration is therefore required before registration acceptance. See docs/cadence-registration.md for execution gates. No protected registry was fetched or changed, no sender token was minted and no live resource was mutated by this readiness work. T05 stays wait pending source delivery and actual native custody/mapping receipts.