Align cadence observer with canonical NetKingdom namespace

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29

docs/CadenceObserverAdmission.md

@@ -0,0 +1,80 @@
+# Canonical cadence observer admission
+
+NK-WP-0035; KG-WP-0005. The observer now consumes source-authored
+`extensions.netkingdom.evidence_class`, matching NetKingdom's profile namespace.
+The historical `extensions.net-kingdom` is refused with an explicit migration
+diagnostic, including conflicting dual-namespace inputs. Missing/malformed owner
+classification is an error; no classifier is inferred from traffic or event names.
+The two local copied fixtures use the canonical namespace. They are local
+algorithm inputs, not deployment, source approval, or profile-wide adoption.
+
+The profile remains proposed. Imported contract is InfoTechCanon candidate
+document 0.2.0 / wire schema 0.1, bundle `b08b4d95fc4b0bd3`, schema SHA256
+`6d52692eb1e4d1325e0d6062d95acded98beddaae5bcfe24c6f0e91f1b6be6ae`.
+Schema validation belongs to the owner artifact; no competing generic schema
+is bundled here. The source class inventory stays source-owned.
+
+## Reuse the evidence engine's delivered interfaces
+
+AUDIT-WP-0009-T04/T05/T06/T07 are done. Reuse, without duplicating:
+
+- `POST /v1/events` authenticated envelope; receiver heartbeat type
+  `audit-core.heartbeat` with asserted covered class at `data.class`.
+- Protected `AUDIT_CORE_SENDERS` registry object carries source-owned canonical
+  `emission_cadence`, plus exact source/tenant/evidence/credential bindings.
+  `heartbeat_classes` maps covered event class to maximum gap seconds.
+  The non-secret scope overlay may add/shorten heartbeat bounds but cannot
+  insert/change `emission_cadence`; platform must provision the protected registry.
+- `GET /v1/reconciliation?source=<exact>&tenant=<exact>&since=<bound>&until=<bound>`
+  gives accepted counts, not payloads. Own-source sender read is allowed with
+  may_read=false; cross-source requests return403. Explicit equal source/tenant
+  and window boundaries are required for a meaningful local comparison.
+- `GET /v1/stream-findings` evaluates missing registered heartbeats and declared
+  rates. It requires a may_read identity with full tenant scope. It is not a
+  tenant-filtered observer feed; request an owner-delivered sanitized observation
+  or separately governed read lane rather than widening a source writer token.
+
+Approval Engine already publishes receiver-compatible heartbeats and has exact
+sender/source `approval-engine`, tenant `tenant:platform`. Its local transition
+classes use bare issuance/use/supersession/revocation while accepted event types
+are approval.issuance/use/supersession/revocation; owner mapping must preserve
+both count coordinates. Requested heartbeat_classes bare classes at172800sec
+must be reconciled with emitted interval86400sec and the receiver's1.5grace.
+Canonical declaration admission and heartbeat mapping need actual owner receipts;
+existing ingestion evidence alone does not prove cadence monitoring was enabled.
+
+Qonto's source is structured stdout, process-instance scoped with event class
+audit.heartbeat and its own source transition/snapshot counters. Its deployment
+owner must deliver a bounded capture and snapshot; no audit-core sender/feed is
+declared in the reviewed receiver source. If routed through Audit Core, owners
+must explicitly translate the heartbeat envelope, bind exact sender+tenant,
+retain source instance/sequence/window semantics, and admit its declaration.
+An unbounded database accepted count cannot replace a process-local snapshot.
+
+local-identity has no registered sender or evidence feed, declares no heartbeat,
+and remains the owner's explicit activity-scoped incompatibility. Do not accept
+reconciliation-only as satisfying NetKingdom's rare-class conjunction or create
+an observation from a local TSV file merely to close adoption.
+
+## Owned operational wait and acceptance
+
+KG-WP-0005-T03 remains wait/blocked on a runtime-owner supplied authorized Qonto
+capture from startup through a request allow/deny, periodic heartbeat at the
+declared interval, and same-instance reconciliation. The namespace migration
+does not produce that feed. `main --live` still drives the adjacent source's
+AuditLogger with a fixture client; it is local emit-path evidence.
+
+Existing executable seams are `live._confirm_stream` (instance/sequence/count
+admission), `cadence.emission_cadence_from_dict` (owner-classified projection),
+`stream.evaluate_stream` (heartbeats/reconciliation/observations), and
+`posture.evaluate_with_stream`. Feed integration must retain source_id/tenant,
+declared heartbeat vs covered-class mapping, time bounds, process instance,
+contiguous sequence and durable/local count scope; missing or malformed inputs
+remain UNKNOWN or are rejected. A runtime owner returns bounded non-secret
+positive/missing-heartbeat/count-divergence plus failed-read receipts. Matching
+counts prove neither completeness nor event occurrence; findings detect omission
+after the fact. There is no automatic containment authority in this delivery.
+
+Knowledge orientation reloaded 2026-10-03: Emergent Security0.2.5 verified-files,
+package digest `9e186dbd6f2d5eb455bca24db4b03cd866c63c4e94660430dd15f2ca9856215f`,
+generic start plus evidence source card. Orientation is not a readiness grant.