audit-core/docs/flex-auth-secrets-engine-admission.md

# First protected workflow: Audit Core admission packet

Prepared 2026-10-16 for TSA-09, AUDIT-WP-0013-T02, FLEX-WP-0031-T02/T06/T08,
SECRETS-WP-0013 and RPF-WP-0035-T12. This packet grants no sender, observer,
credential, deployment or protected effect authority. T02 remains waiting.

## Exact source and receiver compatibility

Reviewed Access source `0a05383195213e7eaacd08388ce1d7892ce756df`, particularly
`internal/emission/outbox.go` and `delivery.go`; Audit base
`2e97f37c01b583ac779310a2aa0d938bb9816604`. The protected consumer pin is
`flex-auth.secrets-engine`, distinct from generic `flex-auth` and other pins.
Access emits the existing eight-field contract in `docs/event-envelope.md`.
No translating adapter or second event schema is needed. Preserve event id,
Idempotency-Key, source, tenant, correlation, original time and data; the archive
does not authenticate a decision signature or establish approval validity.

Inventory: `flex-auth.decision.allow`, `.deny`, `.redact`, `.not_applicable`,
`.audit_only`, plus transport class `audit-core.heartbeat`. Heartbeat data.class
names one exact rare class, with assertion, committed and released_uncommitted
counts. Four heartbeats are four retained events, not four decision counts.
Outbox sequence and committed_at are local entry fields; the current wire event
has no stream_instance_id or sequence. Do not promise native receiver instance
filtering or wire sequence-gap detection for this source merely because the
receiver has that optional filter. Scope, lifetime and boundary are required
before comparing cumulative source counts.

The new isolated receiver tests exercise all five decision types: first202,
same-id duplicate200, changed-body409, write-only read403, independent fixture
readback, exact source/tenant, once-only counts and half-open acceptance-time
boundaries. They exercise wrong scope refusals and class-specific silence.
The identities and narrowed tenant:platform in tests are synthetic fixtures,
not proposed production grants. No live record or real decision validation is
claimed by these tests.

## Existing deployed evidence and its limit

Audit `docs/evidence/2026-10-15-cadence-admission/receiver-cadence-release-native.json`
records image `sha256:b479801b0bc76df66a36a85376c45aaf399c6d82feade9ba81430b774c4a8271`,
Deployment UID `b85fe3d0-75c9-4e0d-8c34-c6f1df0881bb`, source5227fb1 and
synthetic native cadence/heartbeat/exact-scope/SQLite/PostgreSQL feature probes.
The same folder records migration0007 and admitted Qonto/Approval metadata.
These are historical receiver capability receipts, not fresh flex-auth admission
or independent protected-workflow acceptance. Revalidate deployed image, readyz,
configuration metadata and migration compatibility before using them for native
acceptance. No production inspection was performed for this packet.

## Metadata prerequisites before any custody change

Access owner must return one reviewed per-pin registration payload and canonical
cadence bytes/digest for this pin, plus authoritative retained deployment source,
image, namespace `flex-auth`, exact AND namespace/pod selectors and configured
emission source. Do not derive pod selectors solely from a Helm release name.
Existing six-pin commitment in docs/cross-repo-evidence-admission.md requests
write true/read false, exact per-pin source, tenants ["*"] on the recorded
deny-before-tenant-creation justification, explicit redact and load-bearing.
This packet neither narrows that accepted scope to the fixture tenant nor widens
it; a revised scope requires its owner review. Retention/access/export policy
and owner must be explicit; an intake accepting custody is not that policy.

Current `docs/contracts/decision-emission-cadence.json` declares generic
source flex-auth, four heartbeat intervals86400 and allow expected_min1 per3600;
its source state and observer status remain pending. It is not a final per-pin
payload. Its daily source heartbeat cannot be registered as hourly f3600 without
an Access-owned runtime/declaration update and provenance. If hourly frame is
adopted, record f3600/wait7200/effective10800 and prove actual runtime adoption.
Do not silently apply Approval Engine's `cadence_registration.prepare`: that
helper deliberately validates source=approval-engine and its own class set.
The generic SenderRegistry parser already supports the reviewed flex-auth
metadata; custody tooling can validate an in-memory candidate with it.

Platform owns contained sender seed/delivery, registry CAS/readback/ESO reload,
transport and PVC admission. Resolve the actual usable custody route with
`warden route find` and `show` before any credential/access request. Historical
AUDIT-WP-0013-T02 names an unusable draft audit-core-senders route; do not assume
it is corrected. Obtain current route evidence and required scoped approval.
Never copy a registry/token to this packet or give a writer archive-read scope.
Receiver ingress must pair namespace AND exact pod selector to port8080;
source egress and receiver service DNS are separately admitted. Source-owned
single-writer flock/64MiB bound is source progress; actual mounted durable PVC,
restart, full/fenced failure, bounded drain and retained cursor need native proof.

## Native writer acceptance, followed by independent readback

1. Retain source/deployment/configuration pins, registry metadata version/digest,
   source declaration digest, original exact change authorization and rollback.
   Check accepted source/class/tenant/retention/secret policy inventory against
   actual receiver configuration without exporting credentials.
2. Owner runs the approved bounded fixture through its contained existing lane.
   Record durable event IDs, original correlation/decision/approval/operation
   references, source class/tenant, local outbox identity/lifetime and entry
   sequence/committed_at; retain before/after cursor, pending, lag, counters and
   sanitized first202/duplicate200/refusal receipts. No new metadata operation
   is authorized by this packet; where native effect is unadmitted, retain wait.
3. Exercise wrong source/tenant400, invalid/expired bearer401, writer read403,
   payload conflict409 and formerly-valid bearer refusal after owner revocation.
   A dead letter is not accepted custody and a source stdout202 is not readback.
4. Existing independently authorized read-only owner retrieves each exact ID via
   GET /v1/events/{id}; compare source, tenant, action, correlation and normalized
   original payload/hash, plus accepted_at. GET /v1/events?correlation_id=... can
   enumerate related records within that reader's actual authorized scope.
   Record reader identity/role separation metadata and original receiver receipt
   references; credentials stay contained. Existing operator reader is evidence
   of a past lane, not automatic current access. If no admitted scoped reader
   exists, this gate waits on that owner; never upgrade the source writer.
5. Establish the full producer denominator before matching any chosen IDs. The
   independent owner retains the complete producer outbox.jsonl snapshot, source
   revision, outbox/PVC lifetime identity and bytes/SHA256/EOF high-water H. Check
   every newline-terminated entry, contiguous seq1..H, exact source, unique event
   IDs, valid committed_at and complete inventory including zero classes. Pin
   drain cursor seq/offset, committed counters and pending/lag to that snapshot;
   cursor must refer to a real entry boundary and never exceed H. This is an
   independently retained full ledger, not a producer-selected list of successful
   IDs. An arbitrary chosen-ID readback cannot satisfy this denominator. Retain
   independent transition/effect-owner receipts too: an omitted transition never
   queued by a compromised producer remains outside the archive guarantee.
   Compare all ledger IDs versus independently retained receiver records, after
   explicitly declared bounded drain lag. Missing pending
   IDs are lag until the bound expires, then a finding; acknowledged-but-missing
   IDs, conflicts and unexpected IDs are separate findings. Exclude four heartbeat
   transport events from decision-effect totals. Preserve duplicate attempt counts
   while accepted IDs count once. Keep nonzero released_uncommitted as a finding;
   zero observed after restart does not establish its historical absence.
6. For aggregate GET /v1/reconciliation name exact source/tenant and explicit
   [since,until) accepted_at bounds. Derive the local comparison set by the same
   independently read accepted_at of the exact retained IDs, not occurred_at,
   local commit time or a cumulative GET /v1/emission snapshot. Report unresolved
   boundary arrivals separately and repeat after bounded drain. Source status
   lacks tenant/window splits and persisted remote acceptance times; its raw
   total cannot be compared to an arbitrary receiver time-window total. This
   event-ID/accepted_at method supports a bounded admitted run without claiming a
   general unattended reconciliation implementation. Compare the complete map of
   all classes, including unexpected classes, against receiver aggregate counts:
   all expected IDs must exist, and any receiver count above the independently
   enumerated expected map is an unaccounted-record finding. This detects extras
   without pretending GET-by-ID itself enumerates the receiver. Correlation search
   has a1000 ceiling and no pagination; it is not a complete source export.
   Concurrent arrivals require a second independently retained complete ledger
   watermark H2 covering the same receiver window, or an approved quiescent
   bounded run. Do not report agreement while that boundary remains unsettled.
   Independently retained full snapshots, repeated cadence execution, actual
   missing-class observation and independent observer adoption remain required
   for operational TSA-09 acceptance; this packet alone closes none of them.
7. Independently observe four distinct rare-class heartbeats, actual configured
   cadence and lag. A controlled withheld-heartbeat check belongs in an admitted
   non-production exercise; do not suppress production evidence. Keep never-seen,
   stale, missing-class, duplicate, count and boundary findings distinct. King's
   Guard owns independent operational observer acceptance under KG-WP-0005.

Rollback restores only the exact earlier admitted scope/configuration, records
uncertain delivery and retains outbox/cursor/events. It never deletes evidence,
replays an uncertain protected effect, accepts unsigned decisions, widens a grant
or revives a revoked credential. Audit arrival proves custody after arrival;
neither arrival nor an empty finding set proves source completeness. Independent
chain-head/offsite custody remains AUDIT-WP-0015-T01's separate open boundary.

## Cross-owner accounting review — 2026-10-16

Access owner confirms the initial lifecycle signer slice keeps auditDelivery
disabled. Its current native package has no wire/accounting extension and makes
no G2/hourly-adoption claim. Audit owner accepts the complete independently
retained ledger + exact-ID readback + all-class receiver-count protocol above
for a bounded source-to-receiver reconciliation. A source self-selected receipt
list is insufficient. This is an evidence protocol using existing APIs, not a
new assertion format or permission. Audit has no current source-wide paginated
export endpoint or canonical producer-accounting receipt schema. Original owner
ledger bytes and receiver records are authoritative; a Custodian summary is not.

For future unattended monitoring, Access may separately propose durable
outbox-lifetime stream identity and sequence metadata, but must preserve signed
DecisionEnvelope bytes. A receiver-compatible wrapper would need a source-owned
versioned wire contract and fixture changes; post-sign insertion into decision
data is refused. An emitter restart is not automatically a new outbox lifetime.
No producer extension is mandatory for the bounded full-ledger protocol above;
repeated complete producer ledger capture/independent retention and source-owned
per-pin cadence/runtime adoption are mandatory operational work still missing.

The previously skipped existing cross-owner test was run directly from the real
canonical Audit checkout using its actual sibling NetKingdom/Approval fixtures:
`python3 -m pytest -q tests/test_cadence_registration.py::test_real_owner_proposal_when_checkout_available`
passed1. This makes114 tested cases across the focused isolated run and the
canonical owner-fixture check; the isolated run itself remains113 pass/1 skip.
No foreign source was changed (pytest cache writes were denied by the sandbox).