diff --git a/workplans/ADHOC-2026-10-15.md b/workplans/ADHOC-2026-10-15.md deleted file mode 100644 index 2e56986..0000000 --- a/workplans/ADHOC-2026-10-15.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -id: ADHOC-2026-10-15 -type: workplan -title: "Keep shared heartbeat transports bound to covered event classes" -domain: infotech -repo: kings-guard -status: finished -owner: codex -topic_slug: netkingdom -created: "2026-10-15" -updated: "2026-10-15" ---- - -## Prevent one class heartbeat from hiding another class silence - -```task -id: ADHOC-2026-10-15-T01 -status: done -priority: high -``` - -NK-WP-0035 review reproduced a local observer defect: any fresh event with a -shared heartbeat transport name satisfied every covered class. A fresh issuance -beat could mask absent revocation. Added explicit covered_event_classes to the -runtime observation contract, required exact transport-plus-coverage matching, -and migrated Qonto's source adapter and existing positive test inputs. Unscoped -beats no longer vouch for transition classes; malformed coverage is refused. -No Tooling client, live feed or deployment is introduced. - -Regression first failed on the previous implementation with false COMPLETE for -an unscoped shared heartbeat. Tests cover stale revocation with fresh issuance, -positive class-isolated beats, wrong transport, malformed coverage and Qonto's -explicit shared mapping. Operational acceptance remains KG-WP-0005-T03; its -receiver/capture prerequisites remain independently owned. No new live authority -or stream-completeness claim follows from these source tests. - -Validation: full King’s Guard suite **128 passed**. Changed-file Ruff checks -pass. This remains a local observation-contract repair, not signed evidence -or a live source/receiver admission. diff --git a/workplans/KG-WP-0005-qonto-source-cadence-admission.md b/workplans/KG-WP-0005-qonto-source-cadence-admission.md index 7008ced..bf3eafc 100644 --- a/workplans/KG-WP-0005-qonto-source-cadence-admission.md +++ b/workplans/KG-WP-0005-qonto-source-cadence-admission.md @@ -8,7 +8,7 @@ status: active owner: codex topic_slug: netkingdom created: "2026-09-04" -updated: "2026-10-03" +updated: "2026-10-15" origin: cross-repo origin_ref: QONTO-WP-0005 state_hub_workstream_id: "db9c1dfb-cab3-5887-963a-bfcdf01cff69" @@ -112,3 +112,30 @@ credential, live deployment, containment or profile acceptance was changed. > critical path (identity → authz → secrets → SecurityCase execution). Tasks are unchanged; > promote back when demand or risk appears. See the-custodian > `history/20261011-netkingdom-security-progress-assessment.md`. + + +## Covered-class heartbeat repair — 2026-10-15 + +Follow-up to this workplan's completed T02 validation, requested under +NK-WP-0035. Source commit f5bb0f4 fixes a reproduced observer defect: matching +only audit-core.heartbeat let a fresh issuance heartbeat hide revocation +silence. StreamHeartbeat now carries explicit covered_event_classes and the +matcher requires exact transport plus covered class. Unscoped beats cannot +vouch for transition classes; malformed coverage is refused. The Qonto adapter +retains the explicit shared coverage from its source declaration; traffic and +count keys do not infer it. + +The regression first demonstrated false COMPLETE on the old implementation. +Full suite **128 passed**, changed-file Ruff passes. No live receiver/feed, +Tooling client or deployment is introduced. T03 remains wait for actual +runtime capture, sender/mapping and independently scoped receiver evidence. +The current owner requirements are in docs/CadenceObserverAdmission.md. + +Source record reconciliation: the newly authored ADHOC-2026-10-15 had no +managed IDs and failed registration because the shared-topic dated slug already +belongs to audit-core's E2 metadata adoption. Consolidated this source fix into +existing KG-WP-0005-T02; removed only that unindexed local work record. Its +original content remains in f5bb0f4. No audit-core record or existing workplan / +task ID was changed, no Hub row or UUID was invented, and no existing record +was retired or renumbered. This explicitly records the scoped source correction +rather than bypassing a duplicate identity by assigning an arbitrary ID.