Reconcile Staff evidence readiness and retain exact verification residual

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

INTENT.md

@@ -384,3 +384,23 @@ while that is open.
 7. An evidence bundle exports and verifies offline against
    `audit-core`'s record of the same transitions.
 8. No endpoint in this repository answers an authorization question.
+
+
+## Bounded Staff-evidence doctrine response — 2026-10-11
+
+GH-DEC-2026-025 accepts the exact bounded disposition: this repository remains
+Staff/PEP-shaped and carries the unresolved §3.4 deterministic-evidence tension.
+The answer to INFD-IN-0007 is to state that tension openly, not claim it has
+been solved. NetKingdom has assembled a proposed successor; NET-IN-0004 retains
+separate accepted standard voice/publication. Accepted v0.8 remains untouched;
+this source receipt is not acceptance of the whole successor or enrolment by
+another repository. INFD-IN-0007 stays open pending that publication boundary.
+
+The existing independent evidence and identity/approval/PDP limits remain.
+The source now has local transactional evidence/outbox, per-class heartbeat
+and scheduled reconciliation mechanisms; finished INFD-WP-0005/0007 preserve
+those implementation receipts. Full class-specific emission guarantee and
+verification remain owed/not declared, not fulfilled by delivered rows, matching
+counts or a layer/pin PASS. INFD-IN-0009 retains the unpromoted residual source
+verification/declaration work; the §3.4 tension is a separate retained finding.
+Current bounded evidence: docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md.

docs/evidence-path-design.md

@@ -196,9 +196,15 @@ of presentations, dispositions and stance applications compared against
 is indistinguishable from suppression by rate alone — the same argument
 `approval-engine` makes.
 
-This depends on `AUDIT-WP-0009` T04/T06, which we understand are open. We are
+Historical design dependencies were `AUDIT-WP-0009` T04/T06. Current source
-declaring the cadence now and will not describe it as operating until those
+reconciliation on2026-10-11 confirms transactional outbox, per-class heartbeat
-land.
+and scheduled two-time-basis reconciliation now exist; the old dependency
+pointer is not a freshly verified live blocker. Full source class guarantees
+and operation/monitoring verification remain owed under INFD-IN-0009. The
+current worker reports count comparison, not an automatic divergence/loss
+finding or completeness: delayed accepted_at and occurred_at windows differ.
+See docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md. Finished
+INFD-WP-0005/0007 retain their implementation scope and historical receipts.
 
 ## 6. What we need
 

docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md

@@ -0,0 +1,51 @@
+# Staff evidence source reconciliation — 2026-10-11
+
+Derived source-owner review of accepted bounded GH-DEC-2026-025 handoff and
+accepted NetKingdom security-layer-model_v0.8.md §9.6/11; proposed successor
+adoption/publication remains NET-IN-0004. Owner HEAD716e95e8dd97aa6638a08a694481fdb0fa336dd4.
+No native data, credentials, live changes or conformance promotion occurred.
+
+| Declared class | Wire class | Actual source mechanism | Retained native evidence | Remaining verification |
+| --- | --- | --- | --- | --- |
+| presentation: load-bearing/volume | informed-decision.presentation | atomic record/evidence/outbox; heartbeat86400s; pump30s; reconciliation300s | Oct5 receipt:2 selected delivered records with receiver refs and matching class counts | full cadence/detection declaration and time-basis-aware native reconciliation/monitoring; rate monitoring is not declared |
+| disposition: load-bearing/rare | informed-decision.disposition | same transactional/heartbeat/reconciliation mechanism | Oct5 receipt:2 selected delivered records with receiver refs; aggregate audit-core.heartbeat2 | per-target rare heartbeat plus reconciliation/detection operating proof; aggregate heartbeat count identifies no target class |
+| stance-application: load-bearing/rare | informed-decision.stance_application | commit_stance_application/Store record_unreachable; same86400s heartbeat and reconciliation mechanism | selected Oct5 native receipt contains no stance-class record/count; existing synthetic tests cover stance and backlog-safe per-class heartbeat | per-target heartbeat, stance-class native operation and reconciliation/detection proof; no missing-emission finding inferred from an empty historical window |
+
+Source: informed_decision/evidence.py HEARTBEAT_CLASSES declares86400s per
+class. Store queues no nothing-to-report heartbeat when that class or its prior
+heartbeat is undelivered. Actual native class spellings use stance_application;
+this maps the existing declaration's stance-application, not a fourth class.
+AuditPump30s ticks drain bounded batches, write private300s reconciliation and
+close readiness for retry/blocked/pending delivery. A ready pump is not §11
+whole-class completeness or independently monitored cadence proof.
+
+OutboxWorker.reconcile verifies scope/window/shape and compares source occurred_at
+to receiver accepted_at. It explicitly returns automatic_loss_finding=false,
+completeness_proven=false and reconstructability_proven=false. Delayed acceptance
+can shift a legitimate event between windows; matching counts do not establish
+matching membership, complete emission or truthful display. Current source has
+no standalone cadence.yaml; code intervals are a mechanism inventory, not a
+returned fully verified per-class guarantee. Existing tests enforce backlog-safe
+class heartbeats and honest nonclaiming reconciliation; no new test run was
+needed for this documentation-only source review.
+
+Native supporting receipt:
+docs/evidence/2026-10-05-lifecycle-cutover/native-audit-after-acceptance.json.
+Its selected source/receiver totals match, including aggregate heartbeat2,
+presentation2 and disposition2; they do not prove per-target heartbeat or
+stance-class completeness. Additional memo.posed/lifecycle classes in that
+receipt are not substitutes for these three independently classified classes.
+
+Local outbox/scheduling and sender/receiver delivery are implemented, so old
+layer.yaml outbox/AUDIT-WP-0009 blockers are stale. Remaining truthful declaration
+and operating verification are retained once as INFD-IN-0009, an unpromoted
+residual from finished INFD-WP-0007 with related finished INFD-WP-0005. Both
+finished plans remain finished. There is no guarantee/conformance upgrade.
+
+GH-DEC-2026-025 answers INFD-IN-0007 by carrying unresolved §3.4 tension explicitly;
+NET-IN-0004 holds pending separately accepted successor standard voice. Staff/
+PEP-shaped classification, no approval current-state/verdict/consume boundary,
+independent evidence path, view_hash/digest authority and GH-DEC-2026-014
+commitment-only content-availability/compromised-source residuals persist.
+Recording accepted doctrine and actual implementation mechanisms does not resolve
+that tension or accept the successor standard as a whole.

docs/reviews/2026-10-11-staff-evidence-source-owner-review.md

@@ -0,0 +1,34 @@
+# Informed Decision Staff-evidence source-owner review
+
+```yaml
+reviewer: informed-decision-owner (agent informed-decision, codex)
+decision: approved
+work_item: INFD-WP-ADHOC-2026-10-11-T04
+scope: source declaration reconciliation and bounded doctrine receipt only
+comment: >-
+  INTENT.md Purpose, What informed-decision Owns/Does Not Own, and Layer Placement
+  bind presentation evidence emission while reserving authorization/identity/
+  approval state to their owners. Actual source at716e95e8dd97aa6638a08a694481fdb0fa336dd4,
+  accepted bounded GH-DEC-2026-025 handoff and existing Oct5 native audit receipt
+  were reviewed under INFD-WP-ADHOC-2026-10-11-T04. The source receipt distinguishes
+  implemented transactional/outbox/heartbeat/reconciliation mechanisms from
+  still-owed class-specific declaration/operating verification. No conformance,
+  whole-successor adoption or native execution is approved by this review.
+```
+
+The source agrees with the bounded Staff/PEP-shaped carried-tension doctrine;
+INFD-IN-0007 retains the separately accepted standard voice/publication boundary
+under NET-IN-0004. The revised declaration preserves three load-bearing classes
+and owed/not-yet-declarable status, replaces stale blockers with actual current
+verification gaps and explicitly declines completeness. The source receipt
+names exact code and retained native evidence, without promoting aggregate
+heartbeat/count/outbox evidence to whole-class guarantees. INFD-IN-0009 is the
+single unpromoted residual source intake; finished WP5/7 remain historical
+implementation receipts. No implementation is undertaken from that residual.
+
+This review records only informed-decision-owner judgement. It changes no
+privileged authority or approval binding and authorizes no live action, credential
+read, whole standard acceptance or conformance upgrade.
+
+Exact reviewed handoff SHA-256: `1fd8dc06d417c7a0d97920ddc1e51b0fb28113efb8047a8380cd2b9d3ff3289c`.
+Exact source reconciliation receipt SHA-256: `977898b58fb66a50f3852451b86eac194921ca671fac7c4af4882c7914b7d002`.

intakes/intakes.md

@@ -446,8 +446,20 @@ tags:
 - cross-repo
 - conformance
 created: '2026-09-21'
-updated: '2026-09-21'
+updated: '2026-10-11'
 blocks_nothing: true
+bounded_doctrine_response: GH-DEC-2026-025
+accepted_standard_voice_record: NET-IN-0004
+source_evidence_record: INFD-IN-0009
+current_response: >-
+  Accepted bounded doctrine now answers the question by carrying the unresolved
+  section3.4 tension explicitly while retaining Staff/PEP-shaped classification
+  and all evidence/identity/approval boundaries. This does not claim the tension
+  resolved or the whole successor accepted. NET-IN-0004 retains the proposed
+  successor and pending separately accepted standard voice/publication; this
+  intake remains open at that boundary. Current class-specific source guarantee
+  reconciliation is documented in the source evidence receipt, with remaining
+  gaps retained once under INFD-IN-0009 rather than reopening finished WP5/7.
 description: >-
   GH-DEC-2026-017 closed INFD-IN-0006 and named the value: this repository is
   `layer: Staff, role: pep-shaped`, and that value is APPLIED — both files
@@ -510,3 +522,59 @@ description: >-
   fixtures: docs/flex-auth-request-list-action.md.
 state_hub_intake_id: "01a0c5b7-77f3-787b-a19f-ffcfa4191213"
 ```
+
+
+## INFD-IN-0009 — Complete class-specific emission declaration and verification
+
+```yaml
+id: INFD-IN-0009
+kind: intake
+title: Complete class-specific emission declaration and verification
+status: open
+origin: residual
+origin_ref: INFD-WP-0007
+flavor: residual
+priority: medium
+owner: informed-decision
+repo: informed-decision
+lane: blue
+created: '2026-10-11'
+updated: '2026-10-11'
+related:
+- INFD-WP-0005
+- INFD-IN-0007
+- GH-DEC-2026-025
+- NET-IN-0004
+tags:
+- evidence-emission
+- source-declaration
+- verification-gap
+promotion: not-promoted
+description: >-
+  Retain the remaining source guarantee/verification gap after completed initial
+  lifecycle and intake delivery increments, not those increments as unfinished.
+  Presentation(volume), disposition(rare) and stance-application(rare) have
+  transactional local evidence/outbox and 86400-second heartbeat mechanisms;
+  AuditPump schedules30-second drain/300-second two-time-basis reconciliation.
+  Retained native receipt proves selected presentation/disposition delivery and
+  aggregate heartbeat counts, not per-target heartbeat, stance-class operation,
+  independent monitoring/detection or full class emission completeness. Current
+  reconciliation explicitly declines automatic loss/completeness findings and
+  compares occurred_at to accepted_at. Source class-specific cadence/guarantee
+  declaration and bounded verification remain owed/not declared. On promotion,
+  reconcile those actual mechanisms and existing native receipts into honest
+  per-class guarantee/detection evidence, covering rare-class heartbeat plus
+  reconciliation, delayed acceptance/backlog and explicit completeness nonclaim.
+  Volume-class rate monitoring, if selected, needs positive window/minimum and
+  reconciliation. Do not infer conformance from outbox, counts, login or layer
+  PASS; preserve commitment-only availability/compromised-source limits and
+  separate section3.4 tension. No implementation/native inspection/credentials
+  or privileged change is authorized by creation of this residual intake.
+acceptance: >-
+  A source-owned class-by-class declaration names actual detection surfaces and
+  cadence, with bounded independently attributable native verification and
+  explicit remaining completeness/availability limits; required rare heartbeat
+  and time-basis-aware reconciliation/detection are demonstrated, not assumed.
+  Required native actions have their own exact founder disposition.
+source_receipt: docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md
+```

layer.yaml

@@ -123,9 +123,16 @@ shape_ruling: GH-DEC-2026-012
 # which the ruling answers as far as the VALUE and not as far as the FIT.
 # Asked once more of gate-house; no deadline, no dependency, nothing waits on it.
 section_3_4_fit:
-  status: open
+  status: carried-tension
   intake: INFD-IN-0007
   blocks_nothing: true
+  bounded_doctrine_response: GH-DEC-2026-025
+  accepted_standard_voice: pending-NET-IN-0004
+  tension_resolved: false
+  note: >-
+    The bounded founder disposition answers the doctrine question by carrying
+    the tension explicitly. It grants no conformance or Engine-state exception.
+    Accepted successor standard voice/publication remains pending.
 
 # §4 catalog membership — ASKED by GH-DEC-2026-017 §4, ANSWERED here.
 #
@@ -341,10 +348,25 @@ evidence:
       note: Fail-closed stance applied at a binding attempt. Same form as disposition.
   emission_guarantee_status: not-yet-declarable
   emission_guarantee_blocked_on: >-
-    The local transactional outbox (§9.4) and the cadence declaration are
+    Current source implements transactional recording/outbox, 86400-second
-    designed (docs/evidence-path-design.md §5) and depend on audit-core's
+    per-class heartbeats, 30-second pump ticks and 300-second reconciliation.
-    AUDIT-WP-0009 T04/T06 and on sender registration. Declared as owed rather
+    Original AUDIT-WP-0009/outbox pointers are historical, not current verified
-    than described as operating.
+    blockers. Full source class-specific declaration and native verification
+    remain owed: time-basis-aware reconciliation/detection/monitoring and
+    per-target rare-class heartbeat receipts are not established by retained
+    aggregate counts. See INFD-IN-0009; no residual implementation is promoted.
+  completeness_claimed: false
+  reconciliation_review: docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md
+  residual_source_record: INFD-IN-0009
+  mechanism_inventory:
+    local_record_and_outbox: implemented-transactionally
+    heartbeat_seconds_per_declared_class: 86400
+    audit_pump_tick_seconds: 30
+    reconciliation_tick_seconds: 300
+    reconciliation_source_time_basis: occurred_at
+    reconciliation_receiver_time_basis: accepted_at
+    automatic_loss_finding: false
+    operating_full_class_guarantee_verified: false
   note: >-
     GH-DEC-2026-012 states the residual is not closed in those words, and this
     repository is not credited with closing it. Same disposition as

workplans/ADHOC-2026-10-11.md

@@ -98,3 +98,27 @@ unperformed; T04/T05 obligations and temporary vulnerability review persist.
 Confirmation: docs/reviews/2026-10-11-purpose-release-amended-product-owner-review.md.
 Prior T01 catalogue ACK including hub identifiers and T02 initial36 review/test/
 receipt remain unchanged. No new residual or authority is created by this review.
+
+## Reconcile Staff evidence source declaration and current guarantees
+
+```task
+id: INFD-WP-ADHOC-2026-10-11-T04
+status: done
+priority: medium
+```
+
+Reviewed accepted bounded GH-DEC-2026-025 handoff against actual source
+class definitions, transactional recording, heartbeat/reconciliation scheduling,
+existing component-test assertions and native count/receipt evidence. Reconciled
+stale outbox/AUDIT-WP-0009 blockers without promoting owed guarantees or reopening
+finished INFD-WP-0005/0007. INFD-IN-0007 retains doctrine response and pending
+NET-IN-0004 standard voice. INFD-IN-0009 is the one live, unpromoted residual
+source intake for remaining class-specific declaration/verification gaps,
+origin INFD-WP-0007. No residual implementation or native action occurred.
+
+Source evidence reconciliation:
+docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md.
+Formal source review:
+docs/reviews/2026-10-11-staff-evidence-source-owner-review.md.
+Existing Staff/PEP-shaped classification, three load-bearing class classifications,
+compromised-source and commitment/content availability limits remain unchanged.