Close actual Qonto sender coordination with native scoped receipts
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
This commit is contained in:
parent
6c690b0b84
commit
f38912143e
5 changed files with 231 additions and 6 deletions
|
|
@ -0,0 +1,59 @@
|
|||
{
|
||||
"own_reconciliation_status": 200,
|
||||
"own_reconciliation": {
|
||||
"source": "qonto-assistant",
|
||||
"tenant": "tenant:friendly:binky",
|
||||
"since": "2026-10-15T19:36:00+00:00",
|
||||
"until": "2026-10-15T19:37:05.369346+00:00",
|
||||
"counts": [
|
||||
{
|
||||
"class": "audit-core.heartbeat",
|
||||
"count": 1
|
||||
},
|
||||
{
|
||||
"class": "audit.deny",
|
||||
"count": 1
|
||||
}
|
||||
],
|
||||
"stream_instance_id": "b351fa6b-e0d6-4f88-b7c9-6bacb1a112b7",
|
||||
"means": "the count of events audit-core accepted and stored in this window. Divergence from the source's own count is a finding for the source; agreement proves neither completeness nor that any event occurred."
|
||||
},
|
||||
"duplicate_status": 200,
|
||||
"wrong_source_status": 400,
|
||||
"wrong_tenant_status": 400,
|
||||
"read_refusal_status": 403,
|
||||
"invalid_bearer_status": 401,
|
||||
"global_pending_count": 0,
|
||||
"instance_receipts": [
|
||||
{
|
||||
"accepted_at": "2026-10-15T19:36:30.769604+00:00",
|
||||
"covered_event_classes": [
|
||||
"audit.deny"
|
||||
],
|
||||
"event_id": "28dad6de11fb25fe6e0e145351f047360d6898afb53afd4cd677e560ec69132a",
|
||||
"source": "qonto-assistant",
|
||||
"status_code": 202,
|
||||
"stream_instance_id": "b351fa6b-e0d6-4f88-b7c9-6bacb1a112b7",
|
||||
"stream_sequence": 1,
|
||||
"tenant": "tenant:friendly:binky",
|
||||
"type": "audit-core.heartbeat"
|
||||
},
|
||||
{
|
||||
"accepted_at": "2026-10-15T19:36:30.861014+00:00",
|
||||
"covered_event_classes": [],
|
||||
"event_id": "6a9f34445e13062e38ab309a6fc800dc9a2fa24cb8a46ecd919ae18fe9409874",
|
||||
"source": "qonto-assistant",
|
||||
"status_code": 202,
|
||||
"stream_instance_id": "b351fa6b-e0d6-4f88-b7c9-6bacb1a112b7",
|
||||
"stream_sequence": 2,
|
||||
"tenant": "tenant:friendly:binky",
|
||||
"type": "audit.deny"
|
||||
}
|
||||
],
|
||||
"observed_at": "2026-10-15T19:37:03.422744+00:00",
|
||||
"credential_values_emitted": false,
|
||||
"source": "qonto-assistant",
|
||||
"tenant": "tenant:friendly:binky",
|
||||
"stream_instance_id": "b351fa6b-e0d6-4f88-b7c9-6bacb1a112b7",
|
||||
"independent_readback": false
|
||||
}
|
||||
|
|
@ -0,0 +1,37 @@
|
|||
{
|
||||
"receipts": [
|
||||
{
|
||||
"accepted_at": "2026-10-15T19:36:30.769604+00:00",
|
||||
"covered_event_classes": [
|
||||
"audit.deny"
|
||||
],
|
||||
"event_id": "28dad6de11fb25fe6e0e145351f047360d6898afb53afd4cd677e560ec69132a",
|
||||
"source": "qonto-assistant",
|
||||
"status_code": 202,
|
||||
"stream_instance_id": "b351fa6b-e0d6-4f88-b7c9-6bacb1a112b7",
|
||||
"stream_sequence": 1,
|
||||
"tenant": "tenant:friendly:binky",
|
||||
"type": "audit-core.heartbeat"
|
||||
},
|
||||
{
|
||||
"accepted_at": "2026-10-15T19:36:30.861014+00:00",
|
||||
"covered_event_classes": [],
|
||||
"event_id": "6a9f34445e13062e38ab309a6fc800dc9a2fa24cb8a46ecd919ae18fe9409874",
|
||||
"source": "qonto-assistant",
|
||||
"status_code": 202,
|
||||
"stream_instance_id": "b351fa6b-e0d6-4f88-b7c9-6bacb1a112b7",
|
||||
"stream_sequence": 2,
|
||||
"tenant": "tenant:friendly:binky",
|
||||
"type": "audit.deny"
|
||||
}
|
||||
],
|
||||
"pending_count": 0,
|
||||
"started_at": "2026-10-15T19:37:41.503622+00:00",
|
||||
"pod_uid_before": "1a39bd4b-19dc-4c1f-adaa-56a11423d945",
|
||||
"native_admission_receipt": "qonto-collector-native-admission.json",
|
||||
"pod_uid_after": "92ef9104-469c-4b28-a0cc-f781f53bb26e",
|
||||
"observed_at": "2026-10-15T19:38:35.874453+00:00",
|
||||
"first_202_receipts_preserved": true,
|
||||
"pvc": "rapp-qonto-audit-outbox",
|
||||
"image": "forgejo.coulomb.social/coulomb/rapp-qonto-audit-collector@sha256:82bfd4100e14ddb2cefc4acc02b6b74609846b4a26ad40d9089ed564693f250a"
|
||||
}
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
{
|
||||
"independent_readback": false,
|
||||
"observation_scope": "Native scoped sender admission and durable collector restart only; one-hour periodic capture and independent receiver/observer acceptance remain in progress.",
|
||||
"origin_directory": "docs/evidence/2026-10-15-cadence-adoption",
|
||||
"origin_repo": "net-kingdom",
|
||||
"schema_version": "qonto-collector-admission-receipts/v1",
|
||||
"sha256": {
|
||||
"qonto-collector-native-admission.json": "573ce4d63af36f2a770cc032150ab3f45a4e507585b45312cacc0db4d8995cc9",
|
||||
"qonto-collector-restart-persistence.json": "afebe361f85c2558e9c9f9e004cafd7b6d547ca53b0089af103fd17b8b4e5903",
|
||||
"receiver-custody-live.json": "4c50005289cd331fa22d49f8b828e3fd21a4e7077ce855724185051a97baa502"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,87 @@
|
|||
{
|
||||
"schema_version": "platform.cadence-custody/v1",
|
||||
"status": "delivered_pending_native_producer_and_independent_acceptance",
|
||||
"credential_values_emitted": false,
|
||||
"started_at": "2026-10-15T19:35:14.571483+00:00",
|
||||
"packet_sha256": "81478f43abd2dbcb924966e9a3404e26bc226c91f2921b493ef0d5e2c23d4729",
|
||||
"receiver_before": {
|
||||
"image": "forgejo.coulomb.social/coulomb/audit-core@sha256:b479801b0bc76df66a36a85376c45aaf399c6d82feade9ba81430b774c4a8271",
|
||||
"deployment_uid": "b85fe3d0-75c9-4e0d-8c34-c6f1df0881bb",
|
||||
"deployment_resource_version": "75784583",
|
||||
"pod_uid": "22e4df05-dfb0-4e70-8d5a-5a5950c860bd",
|
||||
"capabilities": {
|
||||
"load_bearing": true,
|
||||
"redact": true,
|
||||
"write_only": true,
|
||||
"source_exact": true,
|
||||
"tenant_exact": true
|
||||
},
|
||||
"synthetic_probe_only": true,
|
||||
"credential_reads": 0,
|
||||
"cadence_instance_capabilities": {
|
||||
"cadence_registration": true,
|
||||
"sqlite_instance_filter": true,
|
||||
"postgres_instance_filter": true,
|
||||
"synthetic_cadence_parse": true,
|
||||
"synthetic_heartbeat_parse": true,
|
||||
"synthetic_exact_scope": true
|
||||
}
|
||||
},
|
||||
"phase": "delivery",
|
||||
"registry_version_before": 15,
|
||||
"custody_version": 1,
|
||||
"custody_request_id": "77a526ef-dbcc-147d-b98b-a339f4efcd62",
|
||||
"approval": {
|
||||
"sender": "approval-engine",
|
||||
"source": "approval-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"may_read": false,
|
||||
"emission_cadence_sha256": "cc58c8d53ebf50acf540d73b7607d579942bda7734c3e8722108e9c9204af655",
|
||||
"heartbeat_classes": {
|
||||
"issuance": 7200,
|
||||
"use": 7200,
|
||||
"supersession": 7200,
|
||||
"revocation": 7200
|
||||
},
|
||||
"effective_deadline_seconds": 10800,
|
||||
"changed": true,
|
||||
"credentials_preserved": true,
|
||||
"other_registry_fields_preserved": true
|
||||
},
|
||||
"registry_request_id": "47ca933d-4a5d-699b-c474-094947f78fb9",
|
||||
"registry_version_after": 16,
|
||||
"registry_readback_matches": true,
|
||||
"other_senders_preserved": true,
|
||||
"approval_credentials_preserved": true,
|
||||
"reader_exact_path_negatives_and_revocation": true,
|
||||
"wrong_identity_denied": true,
|
||||
"coding_agent_deny_wins": true,
|
||||
"projection_matches": true,
|
||||
"receiver_registry_projection_matches": true,
|
||||
"receiver_after": {
|
||||
"image": "forgejo.coulomb.social/coulomb/audit-core@sha256:b479801b0bc76df66a36a85376c45aaf399c6d82feade9ba81430b774c4a8271",
|
||||
"deployment_uid": "b85fe3d0-75c9-4e0d-8c34-c6f1df0881bb",
|
||||
"deployment_resource_version": "75785764",
|
||||
"pod_uid": "8333754a-eca0-4dd0-9230-72e41bb1e632",
|
||||
"capabilities": {
|
||||
"load_bearing": true,
|
||||
"redact": true,
|
||||
"write_only": true,
|
||||
"source_exact": true,
|
||||
"tenant_exact": true
|
||||
},
|
||||
"synthetic_probe_only": true,
|
||||
"credential_reads": 0,
|
||||
"cadence_instance_capabilities": {
|
||||
"cadence_registration": true,
|
||||
"sqlite_instance_filter": true,
|
||||
"postgres_instance_filter": true,
|
||||
"synthetic_cadence_parse": true,
|
||||
"synthetic_heartbeat_parse": true,
|
||||
"synthetic_exact_scope": true
|
||||
}
|
||||
},
|
||||
"receiver_reloaded": true,
|
||||
"receiver_runtime_registry_matches": true,
|
||||
"completed_at": "2026-10-15T19:35:47.205117+00:00"
|
||||
}
|
||||
|
|
@ -4,7 +4,7 @@ type: workplan
|
|||
title: "Adopt canonical cadence and establish observer delivery requirements"
|
||||
domain: infotech
|
||||
repo: qonto-assistant
|
||||
status: blocked
|
||||
status: active
|
||||
owner: codex
|
||||
topic_slug: qonto-canonical-cadence-adoption
|
||||
created: "2026-10-03"
|
||||
|
|
@ -42,11 +42,9 @@ validate this declaration without substituting a compatibility schema.
|
|||
|
||||
```task
|
||||
id: QONTO-WP-0006-T02
|
||||
status: wait
|
||||
status: done
|
||||
priority: high
|
||||
blocking_reason: "Runtime owner and audit-core must supply the structured-stdout delivery binding, accepted-class mapping and sender receipts. No actual audit-core sender exists in this source implementation."
|
||||
state_hub_task_id: "77af5db4-8919-5da7-ab91-924a5f8ad63f"
|
||||
blocked_on: message-from:audit-core
|
||||
```
|
||||
|
||||
Qonto runtime owner must provide the pinned collector/sender implementation,
|
||||
|
|
@ -77,9 +75,8 @@ A source fixture or stdout event alone does not close this task.
|
|||
|
||||
```task
|
||||
id: QONTO-WP-0006-T03
|
||||
status: wait
|
||||
status: progress
|
||||
priority: high
|
||||
blocking_reason: King's Guard requires actual sender/mapping proof before independent missing-heartbeat, gap and count-divergence acceptance.
|
||||
state_hub_task_id: 9eb725b2-a9bc-594a-b43b-e24c37dfc6a1
|
||||
depends_on:
|
||||
- QONTO-WP-0006-T02
|
||||
|
|
@ -162,3 +159,36 @@ is3600s,receiver base wait7200,effective10800. Collector source/package43tests
|
|||
pass. T02 remains wait pending immutable release,credential custody/admission
|
||||
and actual accepted receipts; T03 waits independent KG-WP-0005-T03. No source
|
||||
fixture or prepared deployment closes either operational gate.
|
||||
|
||||
|
||||
## Actual collector and receiver admission — 2026-10-15
|
||||
|
||||
T02 is now done within sender coordination/admission scope. RAPP-QONTO-WP-0004-T02
|
||||
and AUDIT-WP-0013-T05 supply actual pinned collector and native sender admission.
|
||||
CCR-2026-0047 exact writer-only source`qonto-assistant`, tenant`tenant:friendly:binky`
|
||||
was delivered via custody version1, registry CAS15→16 and verified ESO/reload.
|
||||
Collector image is `rapp-qonto-audit-collector@sha256:82bfd4100e14ddb2cefc4acc02b6b74609846b4a26ad40d9089ed564693f250a`;
|
||||
receiver is `audit-core@sha256:b479801b0bc76df66a36a85376c45aaf399c6d82feade9ba81430b774c4a8271`.
|
||||
The one-to-one mapping retains source `audit.heartbeat` in data while receiver
|
||||
type is `audit-core.heartbeat`, covering only`audit.deny`; original instance,
|
||||
sequence, counters and window bounds remain intact. Allow stays attributive,
|
||||
deny/heartbeat load-bearing. No transactional atomicity or completeness claim
|
||||
is introduced.
|
||||
|
||||
Actual startup and denied request each returned fresh202 receipts, and scoped
|
||||
exact-instance own reconciliation held one heartbeat and one deny. Duplicate200,
|
||||
wrong-source400, wrong-tenant400, forbidden read403, invalid bearer401 were
|
||||
observed; pending0. A collector pod replacement on the same durable PVC preserved
|
||||
the original202 receipts/timestamps and pending0. Invalid bearer refusal does
|
||||
not establish revocation of a formerly-valid bearer. Original counters remain
|
||||
process-local transitions; retained-log collection cannot recover records lost
|
||||
before capture. Retry/blocking and loss limitations are in the runtime owner
|
||||
collector documentation. Source/package suite51passed, Ruffclean.
|
||||
|
||||
Sanitized native receipts copied with SHA provenance to
|
||||
`docs/evidence/2026-10-15-audit-collector-admission/`. These own-source receiver
|
||||
counts are not independent observer acceptance. T03 is in progress while real
|
||||
full-frame Job`nk-wp-0035-hourly-observation` runs from19:36:07Z, followed by
|
||||
independently admitted receiver readback and King's Guard KG-WP-0005-T03. No
|
||||
periodic elapsed-hour, missing-heartbeat, scale-to-zero or independent acceptance
|
||||
result is asserted early. The proposed NetKingdom profile is unchanged.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue