coulomb/qonto-assistant
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(audit): publish sequenced heartbeat and reconciliation evidence

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ec5-7e2b-7743-ac08-719e1b0f42e2
This commit is contained in:
tegwick 2026-09-05 01:39:48 +02:00
parent fce60099c4
commit b9349782f4
32 changed files with 839 additions and 111 deletions
Download patch file Download diff file Expand all files Collapse all files

13
specs/security-genome.yaml
View file

@ -1,9 +1,9 @@
# Security Genome record for qonto-assistant.
#
# Schema per kings-guard/specs/NetKingdomImmuneArchitecture.md §9.1
# ("Minimum Genome Record"). Kings Guard does not exist as a running system
# yet — this record is written now so no rework is needed once an admission
# or posture-assessment consumer does exist. See docs/SecurityPractice.md.
# ("Minimum Genome Record"). King's Guard now consumes this source's structured
# audit events; the adjacent cadence declaration supplies stream-completeness
# semantics without making the consumer an authority for source intent.
security_genome_record:
id: kg:genome:qonto-assistant
@ -24,7 +24,7 @@ security_genome_record:
criticality: high
identities:
workload_identity: "TBD — pending key-cape/workload-identity integration (QONTO-WP-0004)"
workload_identity: "key-cape JWT verification supported; runtime enforcement is configuration-bound"
deployment_identity: "TBD — pending Railiance placement decision"
capabilities:
@ -84,3 +84,8 @@ security_genome_record:
bound to verified identity. Tolerated until key-cape/flex-auth
integration (QONTO-WP-0004) closes this.
expires_at: null
# Source emission claim for the load-bearing deny observation class. The full
# machine-readable declaration is kept separate so consumers can ingest it
# without interpreting the genome schema.
audit_emission_cadence: audit-emission-cadence.yaml