Revalidate cadence sources and prepare operational adoption gates
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
This commit is contained in:
parent
311620bbdb
commit
730e06dfe2
4 changed files with 245 additions and 4 deletions
|
|
@ -0,0 +1,97 @@
|
|||
{
|
||||
"workplan": "NK-WP-0035",
|
||||
"status": "source-verified; operational acceptance pending",
|
||||
"profile_status": "proposed",
|
||||
"live_observer_proved": false,
|
||||
"source_files": {
|
||||
"approval_source": {
|
||||
"path": "../approval-engine/cadence.yaml",
|
||||
"sha256": "0389be492628e2df0d84a70755c92aaf4a749bc64fbf2772e0c3301c3e1fe5ed"
|
||||
},
|
||||
"qonto_source": {
|
||||
"path": "../qonto-assistant/specs/audit-emission-cadence.yaml",
|
||||
"sha256": "1b4ce5551fdfe638b57c175c0403cfe8e5000742c3fc389f8c1e895cf557ba02"
|
||||
},
|
||||
"generic_schema": {
|
||||
"path": "../info-tech-canon/infospace/schemas/emission-cadence.schema.yaml",
|
||||
"sha256": "6d52692eb1e4d1325e0d6062d95acded98beddaae5bcfe24c6f0e91f1b6be6ae"
|
||||
},
|
||||
"bearer_revocation_receipt": {
|
||||
"path": "../audit-core/docs/evidence/2026-09-15-sender-bearer-revocation.json",
|
||||
"sha256": "8da798005611711f4a3da969597a3763e6c02e41013df5227b0434dc328b6fb3"
|
||||
},
|
||||
"qonto_historical_capture": {
|
||||
"path": "../rapp-qonto/evidence/live/2026-09-05-audit-rollout.json",
|
||||
"sha256": "1cad71fe93ab2a9f7d5dbc99b9aada47c212a7e43813a86ea91f52639e163be9"
|
||||
}
|
||||
},
|
||||
"approval_engine_registration_proposal": {
|
||||
"status": "not-applied; owner deadline decision pending",
|
||||
"sender": "approval-engine",
|
||||
"source": "approval-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"preserve": [
|
||||
"tokens",
|
||||
"secret_policy=redact",
|
||||
"may_write=true",
|
||||
"may_read=false",
|
||||
"existing other senders and registry fields"
|
||||
],
|
||||
"emission_cadence": "Import exact source-owned cadence.yaml at the pinned digest; never use a draft/fallback schema",
|
||||
"class_mapping": {
|
||||
"issuance": "approval.issuance",
|
||||
"use": "approval.use",
|
||||
"supersession": "approval.supersession",
|
||||
"revocation": "approval.revocation",
|
||||
"heartbeat": "audit-core.heartbeat"
|
||||
},
|
||||
"heartbeat_transport": "audit-core.heartbeat",
|
||||
"covered_class_field": "data.class",
|
||||
"source_interval_seconds": 86400,
|
||||
"source_requested_bound_seconds": 172800,
|
||||
"receiver_grace_factor": 1.5,
|
||||
"deadline_options": [
|
||||
{
|
||||
"effective_seconds": 172800,
|
||||
"registration_seconds": 115200
|
||||
},
|
||||
{
|
||||
"effective_seconds": 259200,
|
||||
"registration_seconds": 172800
|
||||
}
|
||||
],
|
||||
"live_steps": [
|
||||
"Owner confirms effective heartbeat deadline and current runtime/source pin",
|
||||
"Review exact protected-registry metadata-only patch preserving credentials and all unrelated entries",
|
||||
"Founder approves exact runtime change; use governed owner custody with contained session and CAS/readback",
|
||||
"Receiver reload under owner change gate; prove actual per-class registration and class-isolated heartbeats",
|
||||
"Emit/drain actual lifecycle transitions under owner-scoped authority; correlate occurrence, acknowledgment and receiver acceptance windows including lag and duplicates",
|
||||
"Independent readback/count comparison and missing-class/lag findings; retain value-safe receipts"
|
||||
],
|
||||
"existing_revocation_proof": "2026-09-15 T1 accepted 202, dropped T1 refused 401, incumbent T0 accepted 202; do not repeat unchanged synthetic proof as if absent"
|
||||
},
|
||||
"qonto": {
|
||||
"required_owner": "rapp-qonto",
|
||||
"missing": "Actual stdout collector/sender source/image/config and governed delivery lane",
|
||||
"authoritative_workload_tenant": "tenant:friendly:binky (rapp-qonto binding; collector mapping still needs source/receiver review)",
|
||||
"receiver_commitment": "AUDIT-WP-0013-T05",
|
||||
"receiver_instance_filter": "Implemented in AUDIT-WP-0013-T04; reviewed release and native proof still required",
|
||||
"source_coordination": "QONTO-WP-0006-T02",
|
||||
"observer_acceptance": "KG-WP-0005-T03 then QONTO-WP-0006-T03",
|
||||
"historical_receipt_limit": "Source-path capture with startup and deny; not independent collector/feed acceptance"
|
||||
},
|
||||
"local_identity": {
|
||||
"status": "explicit incompatibility retained",
|
||||
"expected_findings": [
|
||||
"rare-heartbeat-missing:revoke-token",
|
||||
"rare-heartbeat-missing:serve/token.token_issued"
|
||||
],
|
||||
"completeness_claimed": false
|
||||
},
|
||||
"observer_fix": {
|
||||
"defect": "Shared heartbeat event type could mask silence of another covered class",
|
||||
"change": "Require explicit covered_event_classes as well as matching transport class; retain source/adapter coverage, not inferred traffic/count keys",
|
||||
"old_regression": "False COMPLETE for unscoped audit-core.heartbeat across issuance/revocation",
|
||||
"deployment_or_live_acceptance": false
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,92 @@
|
|||
{
|
||||
"live_observer_proved": false,
|
||||
"reports": {
|
||||
"approval-engine": {
|
||||
"assessment_scope": "supplied-inventory",
|
||||
"conformant": true,
|
||||
"contract_schema": "../info-tech-canon/infospace/schemas/emission-cadence.schema.yaml",
|
||||
"contract_valid": true,
|
||||
"declaration": "../approval-engine/cadence.yaml",
|
||||
"findings": [],
|
||||
"inventory": {
|
||||
"attributive": [],
|
||||
"load_bearing": [
|
||||
"heartbeat"
|
||||
],
|
||||
"rare_load_bearing": [
|
||||
"issuance",
|
||||
"revocation",
|
||||
"supersession",
|
||||
"use"
|
||||
]
|
||||
},
|
||||
"profile": "netkingdom-emission-cadence-security-profile-v0.1",
|
||||
"profile_assessed": true,
|
||||
"summary": {
|
||||
"must": 0,
|
||||
"should": 0
|
||||
}
|
||||
},
|
||||
"local-identity": {
|
||||
"assessment_scope": "supplied-inventory",
|
||||
"conformant": false,
|
||||
"contract_schema": "../info-tech-canon/infospace/schemas/emission-cadence.schema.yaml",
|
||||
"contract_valid": true,
|
||||
"declaration": "local-identity/emission-cadence.yaml",
|
||||
"findings": [
|
||||
{
|
||||
"code": "rare-heartbeat-missing",
|
||||
"event_class": "revoke-token",
|
||||
"level": "MUST",
|
||||
"message": "rare load-bearing evidence requires a positive heartbeat"
|
||||
},
|
||||
{
|
||||
"code": "rare-heartbeat-missing",
|
||||
"event_class": "serve/token.token_issued",
|
||||
"level": "MUST",
|
||||
"message": "rare load-bearing evidence requires a positive heartbeat"
|
||||
}
|
||||
],
|
||||
"inventory": {
|
||||
"attributive": [],
|
||||
"load_bearing": [],
|
||||
"rare_load_bearing": [
|
||||
"revoke-token",
|
||||
"serve/token.token_issued"
|
||||
]
|
||||
},
|
||||
"profile": "netkingdom-emission-cadence-security-profile-v0.1",
|
||||
"profile_assessed": true,
|
||||
"summary": {
|
||||
"must": 2,
|
||||
"should": 0
|
||||
}
|
||||
},
|
||||
"qonto-assistant": {
|
||||
"assessment_scope": "supplied-inventory",
|
||||
"conformant": true,
|
||||
"contract_schema": "../info-tech-canon/infospace/schemas/emission-cadence.schema.yaml",
|
||||
"contract_valid": true,
|
||||
"declaration": "../qonto-assistant/specs/audit-emission-cadence.yaml",
|
||||
"findings": [],
|
||||
"inventory": {
|
||||
"attributive": [
|
||||
"audit.allow"
|
||||
],
|
||||
"load_bearing": [
|
||||
"audit.deny",
|
||||
"audit.heartbeat"
|
||||
],
|
||||
"rare_load_bearing": [
|
||||
"audit.deny"
|
||||
]
|
||||
},
|
||||
"profile": "netkingdom-emission-cadence-security-profile-v0.1",
|
||||
"profile_assessed": true,
|
||||
"summary": {
|
||||
"must": 0,
|
||||
"should": 0
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue