flex-auth/cadence.yaml

# flex-auth (access-engine) — §11 emission guarantee, per event class.
#
# Authority: security-layer-model §9.6 and §11; GH-DEC-2026-018 §2 and §3;
# net-kingdom/canon/standards/emission-cadence-security-profile_v0.1.md.
# Reference instance: approval-engine/cadence.yaml. Detection form:
# gate-house/docs/contracts/approval-emission-detection.md.
#
# WHY THIS FILE EXISTS AND WHY IT IS PER CLASS.
#
# flex-auth asked whether it is a §4 source of evidence for the decision record
# or only the producer of an artifact audit-core sources, declined to take the
# reading that favoured it, and held the question open as declared gap G2.
# GH-DEC-2026-018 §1 ruled that a custodian is never the source of what it
# holds: §9.6 rests on an archive being unable to prove a record was never
# sent, and that sentence has content only because archive and emitter are
# different parties. audit-core reached the same conclusion on its own
# authority (AUDIT-IN-0005) and declined the role. So flex-auth is the source.
#
# GH-DEC-2026-018 §4 ruled the declaration is PER EVENT CLASS and deliberately
# did NOT classify these classes, because §11 forbids a conformance run to
# infer class from event name, payload or observed rate and that prohibition
# binds a ruling as hard as it binds a runner. The classification below is
# therefore flex-auth's, published as §11 requires the source to publish it,
# and it is supplied to a checker rather than derived by one.
#
# The reason it is per class and not per repository: one guarantee averaged
# over a stream carrying both a high-volume allow and a rare deny is an
# average, not a declaration, and rate monitoring over that average cannot see
# the deny go missing. A denial is one of the three paradigm load-bearing
# events §9.6 names, and it is the event an adversary most wants absent.

schema_version: "0.1"
source: flex-auth                     # §4 row `access-engine`; FLEX-DEC-2026-013
kind: load-bearing
form: heartbeat-or-reconciliation
rate_monitoring: forbidden            # class-level exception stated on `allow` only

# STATE. The classification below is published and in force as a declaration.
# The emission pipeline is not built: no sender named flex-auth or
# access-engine is registered with audit-core, no token lane, no scope row, and
# the decision record reaches consumers in the /v1/check response rather than
# into any custody. This file is therefore the declaration §11 requires and not
# a claim that the guarantee is delivered today. The delivery gap is G2 in
# docs/conformance/security-layer-conformance.md, with owner, blocker and
# review date, and it fails CLOSED on its distinguishing case: a stream with no
# declared cadence produces no silence finding, so the failure mode is a missed
# detection and never a manufactured permission.
state: declared-not-yet-emitting
gap: G2                               # docs/conformance/security-layer-conformance.md

heartbeat:
  # Per rare load-bearing class (FLEX-WP-0031-T05), not one combined class: a
  # single heartbeat can go quiet on one suppressed class while the others
  # keep reporting, and rate monitoring is forbidden on all four for the same
  # reason. Each entry names the class it asserts nothing-to-report for.
  classes:
    - class: flex-auth.decision.deny
      interval: 24h
      assertion: nothing-to-report
      missing: finding
    - class: flex-auth.decision.redact
      interval: 24h
      assertion: nothing-to-report
      missing: finding
    - class: flex-auth.decision.not_applicable
      interval: 24h
      assertion: nothing-to-report
      missing: finding
    - class: flex-auth.decision.audit_only
      interval: 24h
      assertion: nothing-to-report
      missing: finding

reconciliation:
  # Declared for EVERY class, including the volume one. Rate monitoring can see
  # a stream stop; it cannot see a targeted subset removed, and a suppression
  # aimed at one subject or one tenant is exactly the shape that leaves the
  # aggregate rate inside its window.
  compare:
    local: committed outbox counts per class
    remote: "audit-core event counts where source=flex-auth"
  divergence: finding
  undrained_local: lag-not-divergence

lag_bound:
  outbox_depth: 100
  outbox_age: 1h
  exceed: finding

# EVENT CLASS INVENTORY.
#
# The classes are the decision-record effect vocabulary of
# `flex-auth.decision-record.v1` (docs/decision-record-contract.md,
# pkg/api.DecisionEffect). Every one of them is load-bearing: a decision record
# is the artifact a consumer's authority rests on, and §17 moved its schema
# here on the ground that it is the one thing in the estate only this
# repository produces.
classes:
  deny:
    action: flex-auth.decision.deny
    evidence_class: load-bearing
    rarity: rare
    rate_monitoring: forbidden
    detection: [heartbeat, reconciliation]
    note: >-
      §9.6's paradigm case, named there by the standard. Rare by nature, which
      is where rate monitoring is the wrong instrument and the stakes are
      highest.
  redact:
    action: flex-auth.decision.redact
    evidence_class: load-bearing
    rarity: rare
    rate_monitoring: forbidden
    detection: [heartbeat, reconciliation]
    note: >-
      A partial denial. It restricts authority, so it carries the same
      suppression incentive as a deny and is classified with it.
  not_applicable:
    action: flex-auth.decision.not_applicable
    evidence_class: load-bearing
    rarity: rare
    rate_monitoring: forbidden
    detection: [heartbeat, reconciliation]
    note: >-
      No policy matched. A consumer fails closed on it, so its absence has the
      same effect as a suppressed deny.
  audit_only:
    action: flex-auth.decision.audit_only
    evidence_class: load-bearing
    rarity: rare
    rate_monitoring: forbidden
    detection: [heartbeat, reconciliation]
    note: >-
      The effect whose entire purpose is the record. A record of it that does
      not arrive is the decision not having happened.
  allow:
    action: flex-auth.decision.allow
    evidence_class: load-bearing
    rarity: volume
    rate_monitoring: permitted        # §3 of the profile: explicitly classified rate-suitable
    expected_rate:
      window: 1h
      minimum: 1
      below_minimum: finding
    detection: [expected-rate, reconciliation]
    note: >-
      Classified volume, and stated as a classification rather than left to be
      inferred from observed traffic. Reconciliation is declared anyway,
      because rate monitoring over an allow stream cannot see a targeted subset
      removed. An allow carries a TTL lifetime, so a suppressed allow expires
      into a denial of service rather than into a standing grant.
  heartbeat:
    action: flex-auth.decision.heartbeat
    evidence_class: operational
    rarity: scheduled
    note: The positive assertion above; not a decision.

bound: >-
  Heartbeat and reconciliation detect loss, outage, drain failure and accident.
  Neither detects a compromised source suppressing an event and its own count
  together — §9.6's stated residual, and §16 puts the independent observer
  outside audit-core's scope. Conformance to this declaration is not a claim of
  stream completeness.