coulomb/kings-guard
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Bind heartbeat observations to explicitly covered classes

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
This commit is contained in:
tegwick 2026-10-15 19:54:51 +02:00
parent 6aea834dc5
commit f5bb0f434a
9 changed files with 239 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

30
docs/CadenceObserverAdmission.md
View file

@ -49,7 +49,10 @@ owner must deliver a bounded capture and snapshot; no audit-core sender/feed is
declared in the reviewed receiver source. If routed through Audit Core, owners
must explicitly translate the heartbeat envelope, bind exact sender+tenant,
retain source instance/sequence/window semantics, and admit its declaration.
An unbounded database accepted count cannot replace a process-local snapshot.
AUDIT-WP-0013-T04 now supports explicit `stream_instance_id` on receiver
reconciliation. A reviewed receiver release is still required, and acceptance
time must be aligned with source/sequence windows. An unbounded database
accepted count cannot replace a process-local snapshot.
local-identity has no registered sender or evidence feed, declares no heartbeat,
and remains the owner's explicit activity-scoped incompatibility. Do not accept
@ -78,3 +81,28 @@ after the fact. There is no automatic containment authority in this delivery.
Knowledge orientation reloaded 2026-10-03: Emergent Security0.2.5 verified-files,
package digest `9e186dbd6f2d5eb455bca24db4b03cd866c63c4e94660430dd15f2ca9856215f`,
generic start plus evidence source card. Orientation is not a readiness grant.
## Heartbeat coverage correction — 2026-10-15
`StreamHeartbeat.covered_event_classes` explicitly names the classes vouched
for by a source or reviewed adapter. Matching requires both the transport
event class and that coverage. Shared `audit-core.heartbeat` transport names
alone cannot let a fresh issuance beat hide an expired revocation beat.
Missing coverage does not satisfy a covered-class obligation; malformed coverage
is refused. Count keys and observed traffic never infer this binding.
The Qonto source adapter explicitly maps its shared heartbeat to the three
classes in its source-owned declaration. This is local source-path evidence,
not admission of a collector or a receiver feed. The same envelope with an
explicit receiver `data.class` must map only to that named class; do not set
all declared classes on every Approval Engine heartbeat.
The existing 2026-09-15 sender bearer-revocation receipt in audit-core already
proves scoped overlap/drop: replacement bearer 202 then 401, incumbent 202,
for approval-engine and informed-decision. Reuse that exact historical proof;
it does not prove lifecycle reconciliation or cadence registry admission.
Receiver applies 1.5 grace to registered heartbeat intervals: the requested
172800 seconds would produce a 259200-second effective deadline. Record the
source/receiver owner decision before admitting that bound; do not silently
claim a 48-hour alert from that registration.