# Secret-use snapshot admission

`adapters.secrets_engine.snapshot_from_engine` consumes the non-secret envelope
returned by `secrets-engine secret-use snapshot --json`. It opens no client and
reads no Engine evidence directory. The caller obtains the Engine response and
supplies an explicit `catalog_id -> (tenant_id, subject_id)` binding; unbound or
duplicate lanes are rejected. Catalog identifiers alone do not establish scope.

| Source field | Consumer meaning |
| --- | --- |
| `surface`, `completeness_claimed` | Require `secret-use-evidence` and explicit `false`. |
| Envelope and lane `as_of` | Snapshot creation time; lane times must match. Not the times of underlying events. |
| `catalog_id`, `stage`, `kind` | Scoped catalog metadata. |
| `ready`, `revocation_attempted`, `revocation_succeeded` | Optional historical booleans. Absence stays unknown; false stays false. |
| `lifecycle_operation`, `evidence_kind` | Source-reported metadata, not a new event or inferred evidence classification. |
| `cadence.form`, `cadence.interval` | Require heartbeat form and a positive interval; translate `1d` to 86400 seconds. |
| Decision IDs, session handles, paths, mounts, field names, extra fields | Not retained in the normalized observation. |

The result is a separate `SecretUseSnapshot`, because `ImmuneObservation`
requires an event actor, event time, and outcome this surface cannot provide.
Readiness never becomes allow/deny. A snapshot older than the declared interval
receives `snapshot:stale`; a future snapshot receives `snapshot:future_timestamp`.
Even a fresh snapshot has **unknown completeness**. Its cadence declaration is
not a received heartbeat. It supplies neither heartbeat assertions nor
reconciliation counts, so generic stream evaluation is not invoked.

Each lane merges independently selected historical evidence. A newly created
snapshot may contain old readiness or revocation information. No content posture
or response proposal is generated from these untimed fields. KG-IN-0005 tracks
source event timestamps/provenance, evidence-class bindings, scoped heartbeat and
reconciliation evidence, and an authorized deployment capture before that lane
can support posture. Snapshot parsing is locally admitted; secret-abuse posture
remains pending.

Cadence examples for Qonto now follow InfoTechCanon
`standard/emission-cadence` 0.1. `extensions.net-kingdom` holds source evidence
classification and rate-monitoring metadata; `extensions.kings-guard` holds
provenance. The old handover spec is historical. Tests validate both fixtures
against the external owner schema when its checkout is available, without a
copied generic schema. NetKingdom profile adoption remains with NK-WP-0035.