diff --git a/canon/standards/emission-cadence-security-profile_v0.1.md b/canon/standards/emission-cadence-security-profile_v0.1.md index 077fd58..3b3e992 100644 --- a/canon/standards/emission-cadence-security-profile_v0.1.md +++ b/canon/standards/emission-cadence-security-profile_v0.1.md @@ -51,7 +51,9 @@ InfoTechCanon corrected its adoption brief: `972c0b6701d1693f` identified the The schema ID is an identifier; supply the file from the owner checkout, not a network download from that hostname. This profile remains proposed pending -owner-instance migration and validation. The King's Guard draft is provenance, +operational source/observer acceptance. Approval Engine and Qonto owner +instances migrated and passed scoped validation on 2026-10-03; that source +validation does not establish deployed delivery or observation. The King's Guard draft is provenance, not a fallback schema. ## 2. Ownership diff --git a/docs/evidence/2026-10-15-cadence-adoption/owner-acceptance-plan.json b/docs/evidence/2026-10-15-cadence-adoption/owner-acceptance-plan.json new file mode 100644 index 0000000..3acc17e --- /dev/null +++ b/docs/evidence/2026-10-15-cadence-adoption/owner-acceptance-plan.json @@ -0,0 +1,97 @@ +{ + "workplan": "NK-WP-0035", + "status": "source-verified; operational acceptance pending", + "profile_status": "proposed", + "live_observer_proved": false, + "source_files": { + "approval_source": { + "path": "../approval-engine/cadence.yaml", + "sha256": "0389be492628e2df0d84a70755c92aaf4a749bc64fbf2772e0c3301c3e1fe5ed" + }, + "qonto_source": { + "path": "../qonto-assistant/specs/audit-emission-cadence.yaml", + "sha256": "1b4ce5551fdfe638b57c175c0403cfe8e5000742c3fc389f8c1e895cf557ba02" + }, + "generic_schema": { + "path": "../info-tech-canon/infospace/schemas/emission-cadence.schema.yaml", + "sha256": "6d52692eb1e4d1325e0d6062d95acded98beddaae5bcfe24c6f0e91f1b6be6ae" + }, + "bearer_revocation_receipt": { + "path": "../audit-core/docs/evidence/2026-09-15-sender-bearer-revocation.json", + "sha256": "8da798005611711f4a3da969597a3763e6c02e41013df5227b0434dc328b6fb3" + }, + "qonto_historical_capture": { + "path": "../rapp-qonto/evidence/live/2026-09-05-audit-rollout.json", + "sha256": "1cad71fe93ab2a9f7d5dbc99b9aada47c212a7e43813a86ea91f52639e163be9" + } + }, + "approval_engine_registration_proposal": { + "status": "not-applied; owner deadline decision pending", + "sender": "approval-engine", + "source": "approval-engine", + "tenant": "tenant:platform", + "preserve": [ + "tokens", + "secret_policy=redact", + "may_write=true", + "may_read=false", + "existing other senders and registry fields" + ], + "emission_cadence": "Import exact source-owned cadence.yaml at the pinned digest; never use a draft/fallback schema", + "class_mapping": { + "issuance": "approval.issuance", + "use": "approval.use", + "supersession": "approval.supersession", + "revocation": "approval.revocation", + "heartbeat": "audit-core.heartbeat" + }, + "heartbeat_transport": "audit-core.heartbeat", + "covered_class_field": "data.class", + "source_interval_seconds": 86400, + "source_requested_bound_seconds": 172800, + "receiver_grace_factor": 1.5, + "deadline_options": [ + { + "effective_seconds": 172800, + "registration_seconds": 115200 + }, + { + "effective_seconds": 259200, + "registration_seconds": 172800 + } + ], + "live_steps": [ + "Owner confirms effective heartbeat deadline and current runtime/source pin", + "Review exact protected-registry metadata-only patch preserving credentials and all unrelated entries", + "Founder approves exact runtime change; use governed owner custody with contained session and CAS/readback", + "Receiver reload under owner change gate; prove actual per-class registration and class-isolated heartbeats", + "Emit/drain actual lifecycle transitions under owner-scoped authority; correlate occurrence, acknowledgment and receiver acceptance windows including lag and duplicates", + "Independent readback/count comparison and missing-class/lag findings; retain value-safe receipts" + ], + "existing_revocation_proof": "2026-09-15 T1 accepted 202, dropped T1 refused 401, incumbent T0 accepted 202; do not repeat unchanged synthetic proof as if absent" + }, + "qonto": { + "required_owner": "rapp-qonto", + "missing": "Actual stdout collector/sender source/image/config and governed delivery lane", + "authoritative_workload_tenant": "tenant:friendly:binky (rapp-qonto binding; collector mapping still needs source/receiver review)", + "receiver_commitment": "AUDIT-WP-0013-T05", + "receiver_instance_filter": "Implemented in AUDIT-WP-0013-T04; reviewed release and native proof still required", + "source_coordination": "QONTO-WP-0006-T02", + "observer_acceptance": "KG-WP-0005-T03 then QONTO-WP-0006-T03", + "historical_receipt_limit": "Source-path capture with startup and deny; not independent collector/feed acceptance" + }, + "local_identity": { + "status": "explicit incompatibility retained", + "expected_findings": [ + "rare-heartbeat-missing:revoke-token", + "rare-heartbeat-missing:serve/token.token_issued" + ], + "completeness_claimed": false + }, + "observer_fix": { + "defect": "Shared heartbeat event type could mask silence of another covered class", + "change": "Require explicit covered_event_classes as well as matching transport class; retain source/adapter coverage, not inferred traffic/count keys", + "old_regression": "False COMPLETE for unscoped audit-core.heartbeat across issuance/revocation", + "deployment_or_live_acceptance": false + } +} diff --git a/docs/evidence/2026-10-15-cadence-adoption/source-assessments.json b/docs/evidence/2026-10-15-cadence-adoption/source-assessments.json new file mode 100644 index 0000000..90a0729 --- /dev/null +++ b/docs/evidence/2026-10-15-cadence-adoption/source-assessments.json @@ -0,0 +1,92 @@ +{ + "live_observer_proved": false, + "reports": { + "approval-engine": { + "assessment_scope": "supplied-inventory", + "conformant": true, + "contract_schema": "../info-tech-canon/infospace/schemas/emission-cadence.schema.yaml", + "contract_valid": true, + "declaration": "../approval-engine/cadence.yaml", + "findings": [], + "inventory": { + "attributive": [], + "load_bearing": [ + "heartbeat" + ], + "rare_load_bearing": [ + "issuance", + "revocation", + "supersession", + "use" + ] + }, + "profile": "netkingdom-emission-cadence-security-profile-v0.1", + "profile_assessed": true, + "summary": { + "must": 0, + "should": 0 + } + }, + "local-identity": { + "assessment_scope": "supplied-inventory", + "conformant": false, + "contract_schema": "../info-tech-canon/infospace/schemas/emission-cadence.schema.yaml", + "contract_valid": true, + "declaration": "local-identity/emission-cadence.yaml", + "findings": [ + { + "code": "rare-heartbeat-missing", + "event_class": "revoke-token", + "level": "MUST", + "message": "rare load-bearing evidence requires a positive heartbeat" + }, + { + "code": "rare-heartbeat-missing", + "event_class": "serve/token.token_issued", + "level": "MUST", + "message": "rare load-bearing evidence requires a positive heartbeat" + } + ], + "inventory": { + "attributive": [], + "load_bearing": [], + "rare_load_bearing": [ + "revoke-token", + "serve/token.token_issued" + ] + }, + "profile": "netkingdom-emission-cadence-security-profile-v0.1", + "profile_assessed": true, + "summary": { + "must": 2, + "should": 0 + } + }, + "qonto-assistant": { + "assessment_scope": "supplied-inventory", + "conformant": true, + "contract_schema": "../info-tech-canon/infospace/schemas/emission-cadence.schema.yaml", + "contract_valid": true, + "declaration": "../qonto-assistant/specs/audit-emission-cadence.yaml", + "findings": [], + "inventory": { + "attributive": [ + "audit.allow" + ], + "load_bearing": [ + "audit.deny", + "audit.heartbeat" + ], + "rare_load_bearing": [ + "audit.deny" + ] + }, + "profile": "netkingdom-emission-cadence-security-profile-v0.1", + "profile_assessed": true, + "summary": { + "must": 0, + "should": 0 + } + } + } +} diff --git a/workplans/NK-WP-0035-emission-cadence-security-profile.md b/workplans/NK-WP-0035-emission-cadence-security-profile.md index 46274cd..dac5854 100644 --- a/workplans/NK-WP-0035-emission-cadence-security-profile.md +++ b/workplans/NK-WP-0035-emission-cadence-security-profile.md @@ -4,13 +4,13 @@ type: workplan title: "Publish the NetKingdom emission-cadence security profile" domain: infotech repo: net-kingdom -status: active +status: blocked flavor: residual owner: codex topic_slug: netkingdom planning_priority: P1 created: "2026-09-04" -updated: "2026-10-03" +updated: "2026-10-15" related: - GH-DEC-2026-004 - canon/standards/security-layer-model_v0.7.md @@ -90,7 +90,7 @@ Python compilation and `git diff --check` pass. id: NK-WP-0035-T04 status: wait blocked_on: message-from:approval-engine -blocking_reason: "Approval Engine and Qonto owner declarations now pass the published schema and supplied-inventory profile; local-identity incompatibility is retained. Requires actual sender cadence mappings, lifecycle delivery/readback/reconciliation and Kings Guard operational feed evidence." +blocking_reason: "Approval Engine effective heartbeat deadline needs owner choice (48h requested; receiver applies 1.5 grace), followed by approved cadence registry/runtime acceptance and lifecycle reconciliation. Qonto needs an actual rapp-qonto collector and AUDIT-WP-0013-T05 sender admission before KG-WP-0005-T03 operational observation. Existing bearer-revocation proof is delivered; local-identity incompatibility remains explicit." priority: high state_hub_task_id: "e3fbc8b8-00d5-57ce-ba0c-19b58044c950" ``` @@ -225,3 +225,53 @@ are retained; do not request identical synthetic checks as missing evidence. > critical path (identity → authz → secrets → SecurityCase execution). Tasks are unchanged; > promote back when demand or risk appears. See the-custodian > `history/20261011-netkingdom-security-progress-assessment.md`. + + +## Resumed implementation — 2026-10-15 + +Founder requested this increment after NK-WP-0031. T04 remains wait; source +revalidation and the reachable observer repair do not satisfy the operational +acceptance gate or promote the proposed profile. + +Current source declarations were rechecked against the exact imported schema +SHA-256. Approval Engine and Qonto pass their explicit owner inventories; +local-identity still fails exactly its two rare-heartbeat obligations, without +a completeness claim. All **27 profile tests pass**. Reports: +[2026-10-15 source assessments](../docs/evidence/2026-10-15-cadence-adoption/source-assessments.json). + +Found and repaired a real King's Guard observer defect: matching only the +shared heartbeat event type let one class's fresh beat mask another class's +silence. `StreamHeartbeat.covered_event_classes` now binds the observation to +its vouched-for classes. The Qonto adapter explicitly retains its source +mapping; unscoped/malformed coverage cannot manufacture a positive. A regression +first reproduced false COMPLETE on the prior code. This is source repair, +not a deployed feed or live acceptance. Full King’s Guard validation is +**128 passed**, with changed-file Ruff checks passing. Owner record: +`kings-guard/workplans/ADHOC-2026-10-15.md`. + +Two stale requirements are corrected in the concrete +[owner acceptance plan](../docs/evidence/2026-10-15-cadence-adoption/owner-acceptance-plan.json): +Audit Core already implements instance-filtered reconciliation in +AUDIT-WP-0013-T04, and its September 15 bearer-revocation receipt proves T1 +accepted then refused while the incumbent stayed accepted. Neither is absent; +the reviewed receiver release and actual lifecycle/window reconciliation +still need their own operational evidence. + +Approval Engine's requested 172800-second heartbeat registration receives +Audit Core's 1.5 grace, yielding 259200 seconds, not a 48-hour effective +alert. Requested source/receiver owner choice before live registration: +115200 seconds plus grace for an effective 48h bound, or the requested +172800 seconds plus grace for an effective 72h bound. No choice or approval +is inferred while that question is pending. + +Qonto has no implemented runtime collector in the reviewed package, only the +historical source capture. Its native admission still requires actual +collector/runtime pins and reviewed tenant/class/lag mapping under +AUDIT-WP-0013-T05, followed by KG-WP-0005-T03. A source fixture, direct log +capture or new Markdown declaration cannot supply this missing implementation. +No runtime, registry, credential or bank API operation was performed. + +Knowledge: Emergent 0.2.6, digest +`8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02`; +start/evidence source guidance directly reviewed, withheld/orientation-only +receipt retained. This supplies no operational authority.