Attach heartbeat repair to existing cadence owner task

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2

workplans/ADHOC-2026-10-15.md

@@ -1,39 +0,0 @@
----
-id: ADHOC-2026-10-15
-type: workplan
-title: "Keep shared heartbeat transports bound to covered event classes"
-domain: infotech
-repo: kings-guard
-status: finished
-owner: codex
-topic_slug: netkingdom
-created: "2026-10-15"
-updated: "2026-10-15"
----
-
-## Prevent one class heartbeat from hiding another class silence
-
-```task
-id: ADHOC-2026-10-15-T01
-status: done
-priority: high
-```
-
-NK-WP-0035 review reproduced a local observer defect: any fresh event with a
-shared heartbeat transport name satisfied every covered class. A fresh issuance
-beat could mask absent revocation. Added explicit covered_event_classes to the
-runtime observation contract, required exact transport-plus-coverage matching,
-and migrated Qonto's source adapter and existing positive test inputs. Unscoped
-beats no longer vouch for transition classes; malformed coverage is refused.
-No Tooling client, live feed or deployment is introduced.
-
-Regression first failed on the previous implementation with false COMPLETE for
-an unscoped shared heartbeat. Tests cover stale revocation with fresh issuance,
-positive class-isolated beats, wrong transport, malformed coverage and Qonto's
-explicit shared mapping. Operational acceptance remains KG-WP-0005-T03; its
-receiver/capture prerequisites remain independently owned. No new live authority
-or stream-completeness claim follows from these source tests.
-
-Validation: full King’s Guard suite **128 passed**. Changed-file Ruff checks
-pass. This remains a local observation-contract repair, not signed evidence
-or a live source/receiver admission.

workplans/KG-WP-0005-qonto-source-cadence-admission.md

@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: netkingdom
 created: "2026-09-04"
-updated: "2026-10-03"
+updated: "2026-10-15"
 origin: cross-repo
 origin_ref: QONTO-WP-0005
 state_hub_workstream_id: "db9c1dfb-cab3-5887-963a-bfcdf01cff69"
@@ -112,3 +112,30 @@ credential, live deployment, containment or profile acceptance was changed.
 > critical path (identity → authz → secrets → SecurityCase execution). Tasks are unchanged;
 > promote back when demand or risk appears. See the-custodian
 > `history/20261011-netkingdom-security-progress-assessment.md`.
+
+
+## Covered-class heartbeat repair — 2026-10-15
+
+Follow-up to this workplan's completed T02 validation, requested under
+NK-WP-0035. Source commit f5bb0f4 fixes a reproduced observer defect: matching
+only audit-core.heartbeat let a fresh issuance heartbeat hide revocation
+silence. StreamHeartbeat now carries explicit covered_event_classes and the
+matcher requires exact transport plus covered class. Unscoped beats cannot
+vouch for transition classes; malformed coverage is refused. The Qonto adapter
+retains the explicit shared coverage from its source declaration; traffic and
+count keys do not infer it.
+
+The regression first demonstrated false COMPLETE on the old implementation.
+Full suite **128 passed**, changed-file Ruff passes. No live receiver/feed,
+Tooling client or deployment is introduced. T03 remains wait for actual
+runtime capture, sender/mapping and independently scoped receiver evidence.
+The current owner requirements are in docs/CadenceObserverAdmission.md.
+
+Source record reconciliation: the newly authored ADHOC-2026-10-15 had no
+managed IDs and failed registration because the shared-topic dated slug already
+belongs to audit-core's E2 metadata adoption. Consolidated this source fix into
+existing KG-WP-0005-T02; removed only that unindexed local work record. Its
+original content remains in f5bb0f4. No audit-core record or existing workplan /
+task ID was changed, no Hub row or UUID was invented, and no existing record
+was retired or renumbered. This explicitly records the scoped source correction
+rather than bypassing a duplicate identity by assigning an arbitrary ID.