audit-core/workplans/AUDIT-WP-0013-cross-repo-sender-admission.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	state_hub_workstream_id
AUDIT-WP-0013	workplan	Complete flex-auth and Qonto sender admission	infotech	audit-core	blocked	codex	audit-evidence-dependencies	2026-10-04	2026-10-04	9e400de2-6ba1-520e-9b25-94aa2470e528

AUDIT-WP-0013 — Complete flex-auth and Qonto sender admission

All independent local receiver work in this plan is complete. Remaining tasks require named owner inputs or attended custody delivery; the workplan is blocked. Requirements are metadata-only and do not authorize deployment, credentials or bank traffic.

Review current owners and publish admission requirements

id: AUDIT-WP-0013-T01
status: done
priority: high
state_hub_task_id: "6f9505d8-81ea-5406-b693-0781b254b38d"

Reviewed AUDIT-IN-0006, FLEX-WP-0031, QONTO-WP-0006 and RAPP-QONTO-WP-0003. Accepted bounded custody/mapping commitments in docs/cross-repo-evidence-admission.md. Flex-auth T03 outbox is already done; transport registration must not wait on it or on downstream drain/observer completion. Exact prefixed heartbeat classes, source-owned rate thresholds and mixed Qonto class semantics are recorded.

Admit six flex-auth pin identities and verify custody

id: AUDIT-WP-0013-T02
status: wait
priority: high
blocking_reason: "flex-auth must return final per-pin cadence/scope/selector payloads; ops-warden routing catalog and railiance-platform attended seed/delivery are not supplied."
blocked_on: message-from:flex-auth
state_hub_task_id: "fff70081-0d6e-5e16-917a-c7cc3204ad53"

AUDIT-IN-0006 / FLEX-WP-0031-T02. Unblock with the six exact source registrations, explicit tenant/secret policies, emission_cadence including source-chosen allow thresholds, namespace/pod selectors, a governed usable catalog lane and attended custody receipts. The current audit-core-senders route is draft/unresolvable and describes an old ops-mason path; correct or replace that owner routing before attended mint. Then prepare scoped overlays and verify acceptance/retry/refusal/count/heartbeat/revocation behavior. may_read stays false. Requirements and owner split are in docs/cross-repo-evidence-admission.md; nothing is activated by this task.

Resolve the load-bearing failure-path declaration

id: AUDIT-WP-0013-T03
status: done
priority: high
state_hub_task_id: "310e28d2-849d-549a-8c4b-d82c23ebad93"

Message 715cf1f2-55dd-4d2d-9b7b-c5dffa0181e5 is a reading, expressly not a ruling. Keep restrictive released_uncommitted classes non-atomic/non-conformant under current text. Do not treat attributive completeness_trade as an exception. This blocks conformance/exception declaration, not custody preparation in T02. Require the decision ID, applicable text/schema revision, classes, failure condition and detection obligations before implementing a new field.

Resolved 2026-10-10 by GH-DEC-2026-024 (gate-house@0192273, message 8b375579): the §9.6 failure-path release is refused. A load-bearing source gets no declared, detectable, direction-limited release, and §11 gets no declaration for one, so no new field is introduced. completeness_trade keeps its attributive-only meaning. That is already enforced: SenderIdentity rejects a completeness_trade on a load-bearing source (audit_core/senders.py, tests/test_senders.py::test_a_load_bearing_source_cannot_be_given_a_completeness_trade). A released_uncommitted class stays non-conformant. audit-core's evidence-source status is no (GH-DEC-2026-018, AUDIT-IN-0005). Registering the AUDIT-IN-0006 senders is still this repo's job, under T02/T05.

Implement receiver process-instance accepted counts

id: AUDIT-WP-0013-T04
status: done
priority: high
state_hub_task_id: "cd7133db-7ce9-5e83-9914-b0e8ecf044a3"

Optional stream_instance_id on GET /v1/reconciliation selects exact retained details.data.stream_instance_id on both backends, preserving source/tenant permissions and bounded acceptance-time windows. Duplicate retries count once; empty/repeated filters are refused. Aggregate response is unchanged without the filter. API and both-backend regressions pass. This addresses one receiver gap for QONTO-WP-0006-T02, not runtime or observer acceptance.

Admit the Qonto collector and verify accepted-class mapping

id: AUDIT-WP-0013-T05
status: wait
priority: high
blocking_reason: "rapp-qonto must supply the actual collector binding, scope/selectors, mapping/lag rules and receiver receipts; qonto-assistant must approve classification and per-class cadence."
blocked_on: message-from:rapp-qonto
state_hub_task_id: "76b59808-abc3-5b8d-b31a-e3fb611f2cbe"

QONTO-WP-0006-T02. Audit-core owns admission and review of accepted mapping; rapp-qonto owns runtime delivery. Required inputs and proposed audit.allow/audit.deny/audit.heartbeat mapping are in docs/cross-repo-evidence-admission.md. Retain original stream instance, sequence and source counts. Approve deterministic retry IDs, heartbeat vouched-for class, authoritative tenant and acceptance-time/sequence-window comparison. Supply pinned collector/runtime artifacts, sanitized success/failure receipts and actual accepted records. Neither source stdout nor finished RAPP-QONTO-WP-0003 closes this gate. KG-WP-0005-T03 observer acceptance follows sender proof, never precedes it.