audit-core/docs/cadence-registration.md

Cadence registry admission — NK-WP-0035

Prepared source, not live acceptance

The 2026-10-15 source frame is f=3600 seconds. Approval Engine declares issuance, use, supersession and revocation heartbeats every f. Register each class wait at 2f=7200; audit-core's existing 1.5 grace makes the effective missing-heartbeat deadline 3f=10800. Class keys are the asserted class names, not the action names approval.issuance etc. Retain write true/read false, source approval-engine and tenant tenant:platform.

audit_core.cadence_registration.prepare takes the protected KV data object, raw source declaration bytes and the reviewed nonsecret proposal. It validates the exact declaration SHA256, source/class/interval/provenance agreement and incumbent scope. It returns the proposed in-memory KV object and metadata-only receipt. Only heartbeat_classes and emission_cadence may change. Every token, rotation overlap, expiry, policy, sibling sender and other KV property remains unchanged. Existing unexpected heartbeat classes refuse a destructive drop. The entire candidate is parsed by the real receiver sender registry parser.

No registry values belong in operator terminals, agent outputs, local files, Git or State Hub. Root's sanctioned contained platform owner process may call this pure API. scripts/register-approval-engine-cadence.py is a silent attended wrapper requiring the warden isolated HOME and non-root platform-admin identity. It defaults to preflight and uses KV-v2 CAS plus exact readback with --apply. It does not mint credentials, synchronize ESO or restart workloads. Consult the current custody route before invoking any credential operation; this helper does not create custody authority.

Receiver artifact and database prerequisite

Read-only native metadata on 2026-10-15 found receiver Deployment UID b85fe3d0-75c9-4e0d-8c34-c6f1df0881bb, ready replicas 1 and image forgejo.coulomb.social/coulomb/audit-core@sha256:ec15f63d49226bfe507af2bc38ffbd5e83f549ba2c6d1ae7a338e7e053f34615. That artifact has heartbeat_classes and stream findings, but does not contain audit_core.emission_cadence or stream_instance_id filtering in either ingest or PostgreSQL. Its database ledger reports migrations 0001-events through 0006-chain. Source adds additive 0007-import-receipts. Applying registry cadence alone to that old image is not receiver cadence admission.

Release gates: verify backup and rollback position; build/test current committed source and pin its immutable image; run the migration Job with the existing migration lease (runtime cannot migrate); verify ledger 0007; update the receiver image without widening selectors/credentials; wait readyz and native feature proof. Then the protected metadata CAS, exact ESO readback and receiver reload must agree on the admitted declaration and class waits. Own-source counts, wrong-scope refusals and actual heartbeat findings need native receipts. No absence-of-finding claim proves completeness or adversarial omission.

Qonto receiver mapping

rapp-qonto owns the collector, qonto-assistant owns declaration/classification, and King's Guard owns independent observation. Proposed sender rapp-qonto-collector permits source qonto-assistant, tenant tenant:friendly:binky, subject qonto-assistant.audit, write true/read false, explicit redact policy. Qonto source ownership must confirm that exact tenant binding. The mixed sender is load-bearing; allow remains attributive in the per-class source inventory. Stable original instance/sequence drives one retry-safe event ID. Allow and deny retain their class; audit.heartbeat maps one-to-one to audit-core.heartbeat, retains event_class audit.heartbeat, and asserts data.class=audit.deny. It does not assert quiet allow activity.

deploy/qonto-collector-ingress.yaml is prepared separately from the general network policies. It admits only namespace rapp-qonto AND pod label app.kubernetes.io/name=rapp-qonto-audit-collector to receiver port8080. The endpoint is http://audit-core.audit-core.svc.cluster.local:8080. Sender admission and collector egress remain independently required. No bank credential or bank API operation is required. Retain sequence, instance, source counters/window boundaries and receiver acceptance-time boundaries; compare only after the explicitly bounded drain lag. Per-instance filtering isolates instances but does not detect gaps on its own.

AUDIT-WP-0013-T05 and NK-WP-0035 remain open until actual accepted records, duplicate/refusal/reconciliation receipts and independent observer evidence are available. Local tests and this prepared ingress are not those receipts.

Native registration follow-up — 2026-10-15

The initial prepared/source and old-artifact observations above are historical. Current b479801b (source5227fb1) passed its native capability gate; migration0007 completed. The guarded protected registry metadata update15→16, ESO projection and receiver reload succeeded. Existing Approval credentials/scope and sibling senders were preserved. Approval cadence and four waits7200 are now loaded; Qonto collector native heartbeat/deny admission and own counts/refusals passed. Local metadata evidence is in docs/evidence/2026-10-15-cadence-admission/. These receipts do not claim independent operational acceptance, four fresh Approval heartbeat observations or an actual hourly periodic Qonto observation.