gate-house/docs/contracts/approval-emission-detection.md

Approval emission detection surface

Owner: gate-house Source: approval-engine Archive: audit-core Observer: kings-guard (silence-as-signal; offered) Status: normative for GH-WP-0002-T04 Date: 2026-08-29 Statute: net-kingdom/canon/standards/security-layer-model_v0.7.md §9.6 Source declaration: approval-engine/cadence.yaml

A hash chain proves accepted records were not altered or truncated. It proves nothing about an event never emitted. Atomicity (the outbox contract) prevents accidental omission. This surface is what makes a silent loss visible.

It does not prevent a compromised source from suppressing. That residual is stated in §9.6 and is not closed here.

Form

Approval evidence is load-bearing and low-volume. Rate monitoring is forbidden: a handful of revocations a month has no rate to drop below, and suppression is indistinguishable from a quiet month.

The required form is heartbeat plus reconciliation. Reference instance: approval-engine/cadence.yaml and approval-engine/docs/emission-cadence.md.

Heartbeat

A signed positive claim: nothing to report, together with per-class transition counts since the previous heartbeat (or since process start on the first). The claim can itself go missing, which is the point.

Field	Value
Class	heartbeat
Interval	24 hours (SHOULD also be emittable on demand)
Assertion	nothing-to-report
Counts	{issuance, use, supersession, revocation} of committed outbox rows
Missing heartbeat	finding

Heartbeat rows use the outbox table and the same at-least-once drain. They are not coupled to an object mutation.

Reconciliation

Compare approval-engine's committed outbox counts per class to audit-core's accepted event counts for source=approval-engine and the corresponding action. Divergence is a finding, not a log line.

Source class	audit-core action
issuance	approval.issuance
use	approval.use
supersession	approval.supersession
revocation	approval.revocation
heartbeat	approval.heartbeat

Undrained local rows are lag, not yet a divergence. A row with drained_at set that audit-core does not hold is the omission case §9.6 names.

Lag bound

Bound	Default (reference)	Exceed
Outbox depth	100 undrained rows	finding
Outbox age	1 hour for the oldest undrained row	finding

These detect a stuck drain. They are not a completeness proof.

What is a finding

• No heartbeat arrives for more than one interval.
• audit-core count for a class is less than the source's drained count for that class.
• Outbox depth or age exceeds the lag bound.

None of these are rate drops. None of these are informational logs.

kings-guard consumes the finding as observation of the stream, not of its contents. Until it reports that it is watching in production, no argument may assume this surface is live (§12). The source MUST still publish the declaration; a detector that is not yet watching does not excuse an undeclared source.

Who owns which half

Half	Owner
Publish cadence and expose committed counts / lag	approval-engine
Hold accepted events and answer per-source per-class counts	audit-core
Raise silence, divergence, and lag as findings	kings-guard
Name the form and the residual	gate-house

Conformance check (queued for statute v0.8 §11)

GH-WP-0002-T05. Mechanically checkable, in the same list as the existing §11 bullets:

• every repository catalogued as an evidence source, or that emits load-bearing evidence, declares its emission guarantee in a machine-readable form at a path named in its layer declaration:
  • load-bearing: local transactional outbox (this contract's shape) and a heartbeat-or-reconciliation cadence declaration;
  • attributive, deliberately non-atomic: the named trade, and a statement that completeness is not claimed.

A new engine catalogued under §9.4 / §4 as an evidence source that ships without this declaration reintroduces the approval omission gap silently. Until v0.8 lands, this paragraph is doctrine; approval-engine's cadence.yaml plus layer.yaml is the reference form.