From f38912143e33adc203d13bebe2822a0fe4b36935 Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 15 Oct 2026 21:40:22 +0200 Subject: [PATCH] Close actual Qonto sender coordination with native scoped receipts Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2 --- .../qonto-collector-native-admission.json | 59 +++++++++++++ .../qonto-collector-restart-persistence.json | 37 ++++++++ .../receipt-provenance.json | 12 +++ .../receiver-custody-live.json | 87 +++++++++++++++++++ ...ONTO-WP-0006-canonical-cadence-adoption.md | 42 +++++++-- 5 files changed, 231 insertions(+), 6 deletions(-) create mode 100644 docs/evidence/2026-10-15-audit-collector-admission/qonto-collector-native-admission.json create mode 100644 docs/evidence/2026-10-15-audit-collector-admission/qonto-collector-restart-persistence.json create mode 100644 docs/evidence/2026-10-15-audit-collector-admission/receipt-provenance.json create mode 100644 docs/evidence/2026-10-15-audit-collector-admission/receiver-custody-live.json diff --git a/docs/evidence/2026-10-15-audit-collector-admission/qonto-collector-native-admission.json b/docs/evidence/2026-10-15-audit-collector-admission/qonto-collector-native-admission.json new file mode 100644 index 0000000..7ba89c4 --- /dev/null +++ b/docs/evidence/2026-10-15-audit-collector-admission/qonto-collector-native-admission.json @@ -0,0 +1,59 @@ +{ + "own_reconciliation_status": 200, + "own_reconciliation": { + "source": "qonto-assistant", + "tenant": "tenant:friendly:binky", + "since": "2026-10-15T19:36:00+00:00", + "until": "2026-10-15T19:37:05.369346+00:00", + "counts": [ + { + "class": "audit-core.heartbeat", + "count": 1 + }, + { + "class": "audit.deny", + "count": 1 + } + ], + "stream_instance_id": "b351fa6b-e0d6-4f88-b7c9-6bacb1a112b7", + "means": "the count of events audit-core accepted and stored in this window. Divergence from the source's own count is a finding for the source; agreement proves neither completeness nor that any event occurred." + }, + "duplicate_status": 200, + "wrong_source_status": 400, + "wrong_tenant_status": 400, + "read_refusal_status": 403, + "invalid_bearer_status": 401, + "global_pending_count": 0, + "instance_receipts": [ + { + "accepted_at": "2026-10-15T19:36:30.769604+00:00", + "covered_event_classes": [ + "audit.deny" + ], + "event_id": "28dad6de11fb25fe6e0e145351f047360d6898afb53afd4cd677e560ec69132a", + "source": "qonto-assistant", + "status_code": 202, + "stream_instance_id": "b351fa6b-e0d6-4f88-b7c9-6bacb1a112b7", + "stream_sequence": 1, + "tenant": "tenant:friendly:binky", + "type": "audit-core.heartbeat" + }, + { + "accepted_at": "2026-10-15T19:36:30.861014+00:00", + "covered_event_classes": [], + "event_id": "6a9f34445e13062e38ab309a6fc800dc9a2fa24cb8a46ecd919ae18fe9409874", + "source": "qonto-assistant", + "status_code": 202, + "stream_instance_id": "b351fa6b-e0d6-4f88-b7c9-6bacb1a112b7", + "stream_sequence": 2, + "tenant": "tenant:friendly:binky", + "type": "audit.deny" + } + ], + "observed_at": "2026-10-15T19:37:03.422744+00:00", + "credential_values_emitted": false, + "source": "qonto-assistant", + "tenant": "tenant:friendly:binky", + "stream_instance_id": "b351fa6b-e0d6-4f88-b7c9-6bacb1a112b7", + "independent_readback": false +} diff --git a/docs/evidence/2026-10-15-audit-collector-admission/qonto-collector-restart-persistence.json b/docs/evidence/2026-10-15-audit-collector-admission/qonto-collector-restart-persistence.json new file mode 100644 index 0000000..2196930 --- /dev/null +++ b/docs/evidence/2026-10-15-audit-collector-admission/qonto-collector-restart-persistence.json @@ -0,0 +1,37 @@ +{ + "receipts": [ + { + "accepted_at": "2026-10-15T19:36:30.769604+00:00", + "covered_event_classes": [ + "audit.deny" + ], + "event_id": "28dad6de11fb25fe6e0e145351f047360d6898afb53afd4cd677e560ec69132a", + "source": "qonto-assistant", + "status_code": 202, + "stream_instance_id": "b351fa6b-e0d6-4f88-b7c9-6bacb1a112b7", + "stream_sequence": 1, + "tenant": "tenant:friendly:binky", + "type": "audit-core.heartbeat" + }, + { + "accepted_at": "2026-10-15T19:36:30.861014+00:00", + "covered_event_classes": [], + "event_id": "6a9f34445e13062e38ab309a6fc800dc9a2fa24cb8a46ecd919ae18fe9409874", + "source": "qonto-assistant", + "status_code": 202, + "stream_instance_id": "b351fa6b-e0d6-4f88-b7c9-6bacb1a112b7", + "stream_sequence": 2, + "tenant": "tenant:friendly:binky", + "type": "audit.deny" + } + ], + "pending_count": 0, + "started_at": "2026-10-15T19:37:41.503622+00:00", + "pod_uid_before": "1a39bd4b-19dc-4c1f-adaa-56a11423d945", + "native_admission_receipt": "qonto-collector-native-admission.json", + "pod_uid_after": "92ef9104-469c-4b28-a0cc-f781f53bb26e", + "observed_at": "2026-10-15T19:38:35.874453+00:00", + "first_202_receipts_preserved": true, + "pvc": "rapp-qonto-audit-outbox", + "image": "forgejo.coulomb.social/coulomb/rapp-qonto-audit-collector@sha256:82bfd4100e14ddb2cefc4acc02b6b74609846b4a26ad40d9089ed564693f250a" +} diff --git a/docs/evidence/2026-10-15-audit-collector-admission/receipt-provenance.json b/docs/evidence/2026-10-15-audit-collector-admission/receipt-provenance.json new file mode 100644 index 0000000..b976ce1 --- /dev/null +++ b/docs/evidence/2026-10-15-audit-collector-admission/receipt-provenance.json @@ -0,0 +1,12 @@ +{ + "independent_readback": false, + "observation_scope": "Native scoped sender admission and durable collector restart only; one-hour periodic capture and independent receiver/observer acceptance remain in progress.", + "origin_directory": "docs/evidence/2026-10-15-cadence-adoption", + "origin_repo": "net-kingdom", + "schema_version": "qonto-collector-admission-receipts/v1", + "sha256": { + "qonto-collector-native-admission.json": "573ce4d63af36f2a770cc032150ab3f45a4e507585b45312cacc0db4d8995cc9", + "qonto-collector-restart-persistence.json": "afebe361f85c2558e9c9f9e004cafd7b6d547ca53b0089af103fd17b8b4e5903", + "receiver-custody-live.json": "4c50005289cd331fa22d49f8b828e3fd21a4e7077ce855724185051a97baa502" + } +} diff --git a/docs/evidence/2026-10-15-audit-collector-admission/receiver-custody-live.json b/docs/evidence/2026-10-15-audit-collector-admission/receiver-custody-live.json new file mode 100644 index 0000000..14014d2 --- /dev/null +++ b/docs/evidence/2026-10-15-audit-collector-admission/receiver-custody-live.json @@ -0,0 +1,87 @@ +{ + "schema_version": "platform.cadence-custody/v1", + "status": "delivered_pending_native_producer_and_independent_acceptance", + "credential_values_emitted": false, + "started_at": "2026-10-15T19:35:14.571483+00:00", + "packet_sha256": "81478f43abd2dbcb924966e9a3404e26bc226c91f2921b493ef0d5e2c23d4729", + "receiver_before": { + "image": "forgejo.coulomb.social/coulomb/audit-core@sha256:b479801b0bc76df66a36a85376c45aaf399c6d82feade9ba81430b774c4a8271", + "deployment_uid": "b85fe3d0-75c9-4e0d-8c34-c6f1df0881bb", + "deployment_resource_version": "75784583", + "pod_uid": "22e4df05-dfb0-4e70-8d5a-5a5950c860bd", + "capabilities": { + "load_bearing": true, + "redact": true, + "write_only": true, + "source_exact": true, + "tenant_exact": true + }, + "synthetic_probe_only": true, + "credential_reads": 0, + "cadence_instance_capabilities": { + "cadence_registration": true, + "sqlite_instance_filter": true, + "postgres_instance_filter": true, + "synthetic_cadence_parse": true, + "synthetic_heartbeat_parse": true, + "synthetic_exact_scope": true + } + }, + "phase": "delivery", + "registry_version_before": 15, + "custody_version": 1, + "custody_request_id": "77a526ef-dbcc-147d-b98b-a339f4efcd62", + "approval": { + "sender": "approval-engine", + "source": "approval-engine", + "tenant": "tenant:platform", + "may_read": false, + "emission_cadence_sha256": "cc58c8d53ebf50acf540d73b7607d579942bda7734c3e8722108e9c9204af655", + "heartbeat_classes": { + "issuance": 7200, + "use": 7200, + "supersession": 7200, + "revocation": 7200 + }, + "effective_deadline_seconds": 10800, + "changed": true, + "credentials_preserved": true, + "other_registry_fields_preserved": true + }, + "registry_request_id": "47ca933d-4a5d-699b-c474-094947f78fb9", + "registry_version_after": 16, + "registry_readback_matches": true, + "other_senders_preserved": true, + "approval_credentials_preserved": true, + "reader_exact_path_negatives_and_revocation": true, + "wrong_identity_denied": true, + "coding_agent_deny_wins": true, + "projection_matches": true, + "receiver_registry_projection_matches": true, + "receiver_after": { + "image": "forgejo.coulomb.social/coulomb/audit-core@sha256:b479801b0bc76df66a36a85376c45aaf399c6d82feade9ba81430b774c4a8271", + "deployment_uid": "b85fe3d0-75c9-4e0d-8c34-c6f1df0881bb", + "deployment_resource_version": "75785764", + "pod_uid": "8333754a-eca0-4dd0-9230-72e41bb1e632", + "capabilities": { + "load_bearing": true, + "redact": true, + "write_only": true, + "source_exact": true, + "tenant_exact": true + }, + "synthetic_probe_only": true, + "credential_reads": 0, + "cadence_instance_capabilities": { + "cadence_registration": true, + "sqlite_instance_filter": true, + "postgres_instance_filter": true, + "synthetic_cadence_parse": true, + "synthetic_heartbeat_parse": true, + "synthetic_exact_scope": true + } + }, + "receiver_reloaded": true, + "receiver_runtime_registry_matches": true, + "completed_at": "2026-10-15T19:35:47.205117+00:00" +} diff --git a/workplans/QONTO-WP-0006-canonical-cadence-adoption.md b/workplans/QONTO-WP-0006-canonical-cadence-adoption.md index 2e8d06d..c687182 100644 --- a/workplans/QONTO-WP-0006-canonical-cadence-adoption.md +++ b/workplans/QONTO-WP-0006-canonical-cadence-adoption.md @@ -4,7 +4,7 @@ type: workplan title: "Adopt canonical cadence and establish observer delivery requirements" domain: infotech repo: qonto-assistant -status: blocked +status: active owner: codex topic_slug: qonto-canonical-cadence-adoption created: "2026-10-03" @@ -42,11 +42,9 @@ validate this declaration without substituting a compatibility schema. ```task id: QONTO-WP-0006-T02 -status: wait +status: done priority: high -blocking_reason: "Runtime owner and audit-core must supply the structured-stdout delivery binding, accepted-class mapping and sender receipts. No actual audit-core sender exists in this source implementation." state_hub_task_id: "77af5db4-8919-5da7-ab91-924a5f8ad63f" -blocked_on: message-from:audit-core ``` Qonto runtime owner must provide the pinned collector/sender implementation, @@ -77,9 +75,8 @@ A source fixture or stdout event alone does not close this task. ```task id: QONTO-WP-0006-T03 -status: wait +status: progress priority: high -blocking_reason: King's Guard requires actual sender/mapping proof before independent missing-heartbeat, gap and count-divergence acceptance. state_hub_task_id: 9eb725b2-a9bc-594a-b43b-e24c37dfc6a1 depends_on: - QONTO-WP-0006-T02 @@ -162,3 +159,36 @@ is3600s,receiver base wait7200,effective10800. Collector source/package43tests pass. T02 remains wait pending immutable release,credential custody/admission and actual accepted receipts; T03 waits independent KG-WP-0005-T03. No source fixture or prepared deployment closes either operational gate. + + +## Actual collector and receiver admission — 2026-10-15 + +T02 is now done within sender coordination/admission scope. RAPP-QONTO-WP-0004-T02 +and AUDIT-WP-0013-T05 supply actual pinned collector and native sender admission. +CCR-2026-0047 exact writer-only source`qonto-assistant`, tenant`tenant:friendly:binky` +was delivered via custody version1, registry CAS15→16 and verified ESO/reload. +Collector image is `rapp-qonto-audit-collector@sha256:82bfd4100e14ddb2cefc4acc02b6b74609846b4a26ad40d9089ed564693f250a`; +receiver is `audit-core@sha256:b479801b0bc76df66a36a85376c45aaf399c6d82feade9ba81430b774c4a8271`. +The one-to-one mapping retains source `audit.heartbeat` in data while receiver +type is `audit-core.heartbeat`, covering only`audit.deny`; original instance, +sequence, counters and window bounds remain intact. Allow stays attributive, +deny/heartbeat load-bearing. No transactional atomicity or completeness claim +is introduced. + +Actual startup and denied request each returned fresh202 receipts, and scoped +exact-instance own reconciliation held one heartbeat and one deny. Duplicate200, +wrong-source400, wrong-tenant400, forbidden read403, invalid bearer401 were +observed; pending0. A collector pod replacement on the same durable PVC preserved +the original202 receipts/timestamps and pending0. Invalid bearer refusal does +not establish revocation of a formerly-valid bearer. Original counters remain +process-local transitions; retained-log collection cannot recover records lost +before capture. Retry/blocking and loss limitations are in the runtime owner +collector documentation. Source/package suite51passed, Ruffclean. + +Sanitized native receipts copied with SHA provenance to +`docs/evidence/2026-10-15-audit-collector-admission/`. These own-source receiver +counts are not independent observer acceptance. T03 is in progress while real +full-frame Job`nk-wp-0035-hourly-observation` runs from19:36:07Z, followed by +independently admitted receiver readback and King's Guard KG-WP-0005-T03. No +periodic elapsed-hour, missing-heartbeat, scale-to-zero or independent acceptance +result is asserted early. The proposed NetKingdom profile is unchanged.