# Canonical cadence observer admission NK-WP-0035; KG-WP-0005. The observer now consumes source-authored `extensions.netkingdom.evidence_class`, matching NetKingdom's profile namespace. The historical `extensions.net-kingdom` is refused with an explicit migration diagnostic, including conflicting dual-namespace inputs. Missing/malformed owner classification is an error; no classifier is inferred from traffic or event names. The two local copied fixtures use the canonical namespace. They are local algorithm inputs, not deployment, source approval, or profile-wide adoption. The profile remains proposed. Imported contract is InfoTechCanon candidate document 0.2.0 / wire schema 0.1, bundle `b08b4d95fc4b0bd3`, schema SHA256 `6d52692eb1e4d1325e0d6062d95acded98beddaae5bcfe24c6f0e91f1b6be6ae`. Schema validation belongs to the owner artifact; no competing generic schema is bundled here. The source class inventory stays source-owned. ## Reuse the evidence engine's delivered interfaces AUDIT-WP-0009-T04/T05/T06/T07 are done. Reuse, without duplicating: - `POST /v1/events` authenticated envelope; receiver heartbeat type `audit-core.heartbeat` with asserted covered class at `data.class`. - Protected `AUDIT_CORE_SENDERS` registry object carries source-owned canonical `emission_cadence`, plus exact source/tenant/evidence/credential bindings. `heartbeat_classes` maps covered event class to maximum gap seconds. The non-secret scope overlay may add/shorten heartbeat bounds but cannot insert/change `emission_cadence`; platform must provision the protected registry. - `GET /v1/reconciliation?source=&tenant=&since=&until=` gives accepted counts, not payloads. Own-source sender read is allowed with may_read=false; cross-source requests return403. Explicit equal source/tenant and window boundaries are required for a meaningful local comparison. - `GET /v1/stream-findings` evaluates missing registered heartbeats and declared rates. It requires a may_read identity with full tenant scope. It is not a tenant-filtered observer feed; request an owner-delivered sanitized observation or separately governed read lane rather than widening a source writer token. Approval Engine already publishes receiver-compatible heartbeats and has exact sender/source `approval-engine`, tenant `tenant:platform`. Its local transition classes use bare issuance/use/supersession/revocation while accepted event types are approval.issuance/use/supersession/revocation; owner mapping must preserve both count coordinates. Requested heartbeat_classes bare classes at172800sec must be reconciled with emitted interval86400sec and the receiver's1.5grace. Canonical declaration admission and heartbeat mapping need actual owner receipts; existing ingestion evidence alone does not prove cadence monitoring was enabled. Qonto's source is structured stdout, process-instance scoped with event class audit.heartbeat and its own source transition/snapshot counters. Its deployment owner must deliver a bounded capture and snapshot; no audit-core sender/feed is declared in the reviewed receiver source. If routed through Audit Core, owners must explicitly translate the heartbeat envelope, bind exact sender+tenant, retain source instance/sequence/window semantics, and admit its declaration. AUDIT-WP-0013-T04 now supports explicit `stream_instance_id` on receiver reconciliation. A reviewed receiver release is still required, and acceptance time must be aligned with source/sequence windows. An unbounded database accepted count cannot replace a process-local snapshot. local-identity has no registered sender or evidence feed, declares no heartbeat, and remains the owner's explicit activity-scoped incompatibility. Do not accept reconciliation-only as satisfying NetKingdom's rare-class conjunction or create an observation from a local TSV file merely to close adoption. ## Owned operational wait and acceptance KG-WP-0005-T03 remains wait/blocked on a runtime-owner supplied authorized Qonto capture from startup through a request allow/deny, periodic heartbeat at the declared interval, and same-instance reconciliation. The namespace migration does not produce that feed. `main --live` still drives the adjacent source's AuditLogger with a fixture client; it is local emit-path evidence. Existing executable seams are `live._confirm_stream` (instance/sequence/count admission), `cadence.emission_cadence_from_dict` (owner-classified projection), `stream.evaluate_stream` (heartbeats/reconciliation/observations), and `posture.evaluate_with_stream`. Feed integration must retain source_id/tenant, declared heartbeat vs covered-class mapping, time bounds, process instance, contiguous sequence and durable/local count scope; missing or malformed inputs remain UNKNOWN or are rejected. A runtime owner returns bounded non-secret positive/missing-heartbeat/count-divergence plus failed-read receipts. Matching counts prove neither completeness nor event occurrence; findings detect omission after the fact. There is no automatic containment authority in this delivery. Knowledge orientation reloaded 2026-10-03: Emergent Security0.2.5 verified-files, package digest `9e186dbd6f2d5eb455bca24db4b03cd866c63c4e94660430dd15f2ca9856215f`, generic start plus evidence source card. Orientation is not a readiness grant. ## Heartbeat coverage correction — 2026-10-15 `StreamHeartbeat.covered_event_classes` explicitly names the classes vouched for by a source or reviewed adapter. Matching requires both the transport event class and that coverage. Shared `audit-core.heartbeat` transport names alone cannot let a fresh issuance beat hide an expired revocation beat. Missing coverage does not satisfy a covered-class obligation; malformed coverage is refused. Count keys and observed traffic never infer this binding. The Qonto source adapter explicitly maps its shared heartbeat to the three classes in its source-owned declaration. This is local source-path evidence, not admission of a collector or a receiver feed. The same envelope with an explicit receiver `data.class` must map only to that named class; do not set all declared classes on every Approval Engine heartbeat. The existing 2026-09-15 sender bearer-revocation receipt in audit-core already proves scoped overlap/drop: replacement bearer 202 then 401, incumbent 202, for approval-engine and informed-decision. Reuse that exact historical proof; it does not prove lifecycle reconciliation or cadence registry admission. Receiver applies 1.5 grace to registered heartbeat intervals: the requested 172800 seconds would produce a 259200-second effective deadline. Record the source/receiver owner decision before admitting that bound; do not silently claim a 48-hour alert from that registration.