tegwick
2e97f37c01
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
87 lines
5.3 KiB
Markdown
87 lines
5.3 KiB
Markdown
# Cadence registry admission — NK-WP-0035
|
|
|
|
## Prepared source, not live acceptance
|
|
|
|
The 2026-10-15 source frame is f=3600 seconds. Approval Engine declares
|
|
issuance, use, supersession and revocation heartbeats every f. Register each
|
|
class wait at 2f=7200; audit-core's existing 1.5 grace makes the effective
|
|
missing-heartbeat deadline 3f=10800. Class keys are the asserted class names,
|
|
not the action names approval.issuance etc. Retain write true/read false,
|
|
source approval-engine and tenant tenant:platform.
|
|
|
|
`audit_core.cadence_registration.prepare` takes the protected KV data object,
|
|
raw source declaration bytes and the reviewed nonsecret proposal. It validates
|
|
the exact declaration SHA256, source/class/interval/provenance agreement and
|
|
incumbent scope. It returns the proposed in-memory KV object and metadata-only
|
|
receipt. Only heartbeat_classes and emission_cadence may change. Every token,
|
|
rotation overlap, expiry, policy, sibling sender and other KV property remains
|
|
unchanged. Existing unexpected heartbeat classes refuse a destructive drop.
|
|
The entire candidate is parsed by the real receiver sender registry parser.
|
|
|
|
No registry values belong in operator terminals, agent outputs, local files,
|
|
Git or State Hub. Root's sanctioned contained platform owner process may call
|
|
this pure API. `scripts/register-approval-engine-cadence.py` is a silent
|
|
attended wrapper requiring the warden isolated HOME and non-root platform-admin
|
|
identity. It defaults to preflight and uses KV-v2 CAS plus exact readback with
|
|
--apply. It does not mint credentials, synchronize ESO or restart workloads.
|
|
Consult the current custody route before invoking any credential operation;
|
|
this helper does not create custody authority.
|
|
|
|
## Receiver artifact and database prerequisite
|
|
|
|
Read-only native metadata on 2026-10-15 found receiver Deployment UID
|
|
b85fe3d0-75c9-4e0d-8c34-c6f1df0881bb, ready replicas 1 and image
|
|
forgejo.coulomb.social/coulomb/audit-core@sha256:ec15f63d49226bfe507af2bc38ffbd5e83f549ba2c6d1ae7a338e7e053f34615.
|
|
That artifact has heartbeat_classes and stream findings, but does not contain
|
|
audit_core.emission_cadence or stream_instance_id filtering in either ingest
|
|
or PostgreSQL. Its database ledger reports migrations 0001-events through
|
|
0006-chain. Source adds additive 0007-import-receipts. Applying registry cadence
|
|
alone to that old image is not receiver cadence admission.
|
|
|
|
Release gates: verify backup and rollback position; build/test current committed
|
|
source and pin its immutable image; run the migration Job with the existing
|
|
migration lease (runtime cannot migrate); verify ledger 0007; update the receiver
|
|
image without widening selectors/credentials; wait readyz and native feature
|
|
proof. Then the protected metadata CAS, exact ESO readback and receiver reload
|
|
must agree on the admitted declaration and class waits. Own-source counts,
|
|
wrong-scope refusals and actual heartbeat findings need native receipts.
|
|
No absence-of-finding claim proves completeness or adversarial omission.
|
|
|
|
## Qonto receiver mapping
|
|
|
|
rapp-qonto owns the collector, qonto-assistant owns declaration/classification,
|
|
and King's Guard owns independent observation. Proposed sender
|
|
rapp-qonto-collector permits source qonto-assistant, tenant tenant:friendly:binky,
|
|
subject qonto-assistant.audit, write true/read false, explicit redact policy.
|
|
Qonto source ownership must confirm that exact tenant binding. The mixed
|
|
sender is load-bearing; allow remains attributive in the per-class source
|
|
inventory. Stable original instance/sequence drives one retry-safe event ID.
|
|
Allow and deny retain their class; audit.heartbeat maps one-to-one to
|
|
audit-core.heartbeat, retains event_class audit.heartbeat, and asserts
|
|
`data.class=audit.deny`. It does not assert quiet allow activity.
|
|
|
|
`deploy/qonto-collector-ingress.yaml` is prepared separately from the general
|
|
network policies. It admits only namespace rapp-qonto AND pod label
|
|
app.kubernetes.io/name=rapp-qonto-audit-collector to receiver port8080.
|
|
The endpoint is http://audit-core.audit-core.svc.cluster.local:8080.
|
|
Sender admission and collector egress remain independently required. No bank
|
|
credential or bank API operation is required. Retain sequence, instance,
|
|
source counters/window boundaries and receiver acceptance-time boundaries;
|
|
compare only after the explicitly bounded drain lag. Per-instance filtering
|
|
isolates instances but does not detect gaps on its own.
|
|
|
|
AUDIT-WP-0013-T05 and NK-WP-0035 remain open until actual accepted records,
|
|
duplicate/refusal/reconciliation receipts and independent observer evidence
|
|
are available. Local tests and this prepared ingress are not those receipts.
|
|
|
|
## Native registration follow-up — 2026-10-15
|
|
|
|
The initial prepared/source and old-artifact observations above are historical.
|
|
Current b479801b (source5227fb1) passed its native capability gate; migration0007
|
|
completed. The guarded protected registry metadata update15→16, ESO projection
|
|
and receiver reload succeeded. Existing Approval credentials/scope and sibling
|
|
senders were preserved. Approval cadence and four waits7200 are now loaded;
|
|
Qonto collector native heartbeat/deny admission and own counts/refusals passed.
|
|
Local metadata evidence is in `docs/evidence/2026-10-15-cadence-admission/`.
|
|
These receipts do not claim independent operational acceptance, four fresh
|
|
Approval heartbeat observations or an actual hourly periodic Qonto observation.
|