kings-guard/workplans/KG-WP-0005-qonto-source-cadence-admission.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	origin	origin_ref	state_hub_workstream_id	flavor
KG-WP-0005	workplan	Admit and validate qonto-assistant source completeness evidence	infotech	kings-guard	active	codex	netkingdom	2026-09-04	2026-10-15	cross-repo	QONTO-WP-0005	db9c1dfb-cab3-5887-963a-bfcdf01cff69	residual

Admit and Validate Qonto-Assistant Source Completeness Evidence

Qonto-assistant has shipped the source-side contract requested by KG-WP-0003: source-owned cadence, instance and sequence fields, startup/periodic/shutdown heartbeats, and a reconciliation view. Kings-guard must consume and validate those claims without confusing source transition counts with authorization or claiming completeness beyond an observed process instance.

Consume source-emitted observation context

id: KG-WP-0005-T01
status: done
priority: high
state_hub_task_id: "f65d9f88-2ce3-5b32-b3a0-2395d79c5923"

Prefer source-emitted identity_binding and egress_destination over legacy normalization hints, retain the hints for old records, and prove the live mapping does not drift.

Validate cadence, heartbeat, sequence, and reconciliation locally

id: KG-WP-0005-T02
status: done
priority: high
state_hub_task_id: "4978e781-ad4a-5601-ac18-d67dbab61885"

Consume the source-owned cadence separately from kings-guard's Taxonomy draft. Drive qonto-assistant's real AuditLogger emit path, require one stream instance with contiguous sequence numbers, translate heartbeat claims, compare source transition counts with captured request evidence, and prove the resulting deny stream evaluates complete without findings.

Validate the deployed stream

id: KG-WP-0005-T03
status: wait
blocked_on: message-from:qonto-assistant
blocking_reason: "Operational evidence from an authorized deployed qonto-assistant process; local source-path proof does not substitute."
priority: medium
state_hub_task_id: "d2f59a1b-ee01-51b5-b9b6-6e7875d6c988"

Observe an authorized deployed qonto-assistant process from startup through at least one allow/deny transition and reconciliation read. Confirm the deployed configuration emits periodic heartbeats at the declared interval, preserves sequence/instance semantics, and produces no unexplained divergence. This is operational evidence; the local source-path proof does not substitute for it.

Review 2026-09-05: Local source-path tests pass with source context, heartbeat counters, sequence and reconciliation checks. The canonical cadence fixture migration and rejection-path hardening are tracked in KG-WP-0006. T03 remains waiting: the source workplan explicitly leaves deployment with the runtime owner; this repository supplies no authorized deployed stream endpoint or process-lifecycle observation route. Required input is a runtime-owner capture from startup, a request transition, periodic heartbeat timing, and a same-instance reconciliation snapshot. No cluster or Tooling client was used.

Blocked 2026-09-27: T01 and T02 remain the only work completable inside this repo; both are done. T03 needs a runtime-owner capture of an authorized deployed process (startup, an allow/deny transition, periodic heartbeat timing, and a same-instance reconciliation read) that this Staff-layer repo has no route to produce itself — AGENTS.md forbids opening a direct client to a Tooling-layer system or deployment to obtain it. Workplan moved from active to blocked pending that external input; no further action is possible here until it arrives.

Align the observer with the NetKingdom profile namespace

id: KG-WP-0005-T04
status: done
priority: high
state_hub_task_id: "461c62b1-147b-5465-9f3f-38cad0ed753e"

2026-10-03: migrated the parser and both copied cadence fixtures to source-owned extensions.netkingdom. Legacy extensions.net-kingdom, conflicting dual namespace, missing/malformed profile or invalid classification receive explicit rejection diagnostics; classifications are never inferred. Tests retain generic owner-schema checks and source fixture-only evidence. See docs/CadenceObserverAdmission.md.

T03 remains the owned operational wait: require runtime-owner deployed startup, allow/deny, periodic heartbeat and same-instance snapshot plus actual receiver read/mapping receipts. Reuse AUDIT-WP-0009's delivered reconciliation, cadence registration and findings interfaces. No source sender, protected registry, credential, live deployment, containment or profile acceptance was changed.

2026-10-11: demoted to flavor: residual / backlog by founder-authorized triage — off the critical path (identity → authz → secrets → SecurityCase execution). Tasks are unchanged; promote back when demand or risk appears. See the-custodian history/20261011-netkingdom-security-progress-assessment.md.

Covered-class heartbeat repair — 2026-10-15

Follow-up to this workplan's completed T02 validation, requested under NK-WP-0035. Source commit f5bb0f4 fixes a reproduced observer defect: matching only audit-core.heartbeat let a fresh issuance heartbeat hide revocation silence. StreamHeartbeat now carries explicit covered_event_classes and the matcher requires exact transport plus covered class. Unscoped beats cannot vouch for transition classes; malformed coverage is refused. The Qonto adapter retains the explicit shared coverage from its source declaration; traffic and count keys do not infer it.

The regression first demonstrated false COMPLETE on the old implementation. Full suite 128 passed, changed-file Ruff passes. No live receiver/feed, Tooling client or deployment is introduced. T03 remains wait for actual runtime capture, sender/mapping and independently scoped receiver evidence. The current owner requirements are in docs/CadenceObserverAdmission.md.

Source record reconciliation: the newly authored ADHOC-2026-10-15 had no managed IDs and failed registration because the shared-topic dated slug already belongs to audit-core's E2 metadata adoption. Consolidated this source fix into existing KG-WP-0005-T02; removed only that unindexed local work record. Its original content remains in f5bb0f4. No audit-core record or existing workplan / task ID was changed, no Hub row or UUID was invented, and no existing record was retired or renumbered. This explicitly records the scoped source correction rather than bypassing a duplicate identity by assigning an arbitrary ID.

Operational acceptance preparation — 2026-10-15

Under NK-WP-0035, added an executable offline deployed-capture verifier and independent per-class receiver-silence comparison to kings_guard.acceptance. It checks real periodic elapsed time, contiguous source instance/sequence, source snapshot, exact receiver source/tenant/instance counts, durable receipt coverage, and first202 delivery-lag upper bounds. Duplicate200 receipts cannot establish original acceptance time. Input SHA256 pins and bounded conclusions prevent local fixture success from becoming a live conformance claim.

Full suite144 passed (16 new regressions), changed-file Ruff passes. Runtime owner input and actual negative/read/restart/scale-to-zero observation matrix remain required; T03 remains wait. Detailed command, artifact contract, health polling during hourly observation, shutdown interpretation and owner boundaries are in docs/CadenceObserverAdmission.md. No live resource or credential client was opened and no live acceptance receipt was fabricated.