railiance-platform/workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	origin	origin_ref	state_hub_workstream_id
RPF-WP-0059	workplan	Admit hourly receiver cadence and exact Qonto collector custody	financials	railiance-platform	active	codex	railiance-platform	2026-10-15	2026-10-15	cross-repo	NK-WP-0035	d57eeafb-c406-5e1e-841c-5d1288aacabf

Hourly receiver cadence and Qonto collector custody

Prepare exact bounded source packet

id: RPF-WP-0059-T01
status: done
priority: high
state_hub_task_id: "a464dc7e-59c2-5efa-b560-e21e50c1e0e0"

Prepare CCR-2026-0047, exact-only reader policy, namespace-restricted ESO projection and silent attended owner runner. Preserve Approval credentials and all other senders while admitting its source cadence and the new Qonto sender. Focused model tests cover CAS0, CAS-preserving merge, version1 resume, interruption, provenance/scope drift, exact ESO resume/template refusal and no-native proposed refusal. Details: docs/cadence-receiver-custody.md.

Review new grant and complete concrete packet

id: RPF-WP-0059-T02
status: done
priority: high
state_hub_task_id: "fd338306-bdff-5335-ae1f-2c54f277f8e8"

Explicit approval required from platform operator, Audit Core, rapp-qonto and qonto-assistant owners. CCR0047 is approved by the explicit user response "Approve packet and proceed", recorded with all four owner roles on 2026-10-15. Prior timing rollout approval is not a new bearer grant. Review the post-approval exact packet SHA256 and immutable compatible receiver image before attended execution.

Execute attended custody, delivery and receiver readback

id: RPF-WP-0059-T03
status: done
priority: high
state_hub_task_id: "c4e69d60-030e-592b-ac56-9f77468f7da9"

After T02 and the reviewed receiver release, use Warden platform-admin --exec. Record independent session exit/self-revocation and native command receipt. Run exact grant/negative checks and ESO/runtime registry equality; use durable resume on interruption. No live effect or secret read occurred in preparation.

Collect actual producer and independent observer acceptance

id: RPF-WP-0059-T04
status: progress
priority: high
state_hub_task_id: "7d8e5315-9470-5596-a865-d451284f6f50"

Coordinate QONTO-WP-0006-T02, AUDIT-WP-0013-T05 and KG-WP-0005-T03. Preserve source/tenant/instance scope and real elapsed-hour periodic evidence, isolated wrong-namespace denial, actual formerly-valid bearer revocation, independent protected readback, missing-class/lag/divergence, restart/scale-zero evidence. Never infer profile acceptance from a model test or registry projection.

Native admission progress — 2026-10-15

Root executed the explicit approved packet in an attended platform-admin session. Wrapper exit0 and self-revocation confirmed; receiver-custody-live.json records registry15→16 CAS, durable version1 custody, preserved Approval credentials/other senders, reader scope/negative/revoke checks, ESO projection and actual loaded registry equality, and Ready receiver reload. CCR0047 is applied, not verified/active. An initial ambient OPENBAO_TOKEN attempt was correctly refused before custody mutation; that session also self-revoked. Retry removed token aliases before launching OIDC, without relaxing guards.

Collector native receipt proves heartbeat1/deny1 own-instance reconciliation, duplicate200, wrong-source400/wrong-tenant400/archive-read403/invalid-bearer401, pending0; actual collector pod restart preserved first202 receipts and pending0. Exact root receipts copied to docs/evidence/2026-10-15-cadence-receiver/. The real hourly observation started19:36 UTC with authorized health polling; it is still running. No elapsed-hour or independent observer acceptance is claimed. T04 remains progress for actual timed capture and protected readback.