--- id: RISK-F-0011 type: finding title: "qonto-assistant audit.deny stream completeness is not established" status: open owner: risk-nexus reported_by: kings-guard reported_via: gate-house routed_by: gate-house date_reported: "2026-09-01" date_filed: "2026-09-02" system: qonto-assistant environment: production fix_owner: qonto-assistant fix_tracking: QONTO-WP-0005 / KG-WP-0005-T03 closure_condition: "authorized deployed-instance capture accepted by kings-guard: heartbeat timing, sequence continuity and same-instance reconciliation" verification: RISK-V-0003 # Graded by risk-nexus 2026-09-02 — docs/rulings/2026-09-02-qonto-deny-stream.md severity: medium severity_at_production: medium impact: I2 likelihood: L3 fidelity_modifier: false production_rescore: false disclosure: public publication: pending-handover publication_id: risk-f-0011-qonto-audit-deny-stream-completeness publication_path: "findings/qonto-audit-deny-stream-completeness/v1/index.html" publication_subtitle: "A live deny was observed on qonto-assistant, but nothing yet lets anyone claim the load-bearing deny stream is complete." revision: "graded-1" last_reviewed: "2026-09-02" review_interval: 6m escalation: none last_checked: "2026-09-05T00:05:51Z" next_check: "2026-09-05T00:05:51Z" cadence: instant clean_streak: 0 waiting_on: - who: qonto-assistant what: "supply runtime-owner deployed-instance capture for kings-guard acceptance under KG-WP-0005-T03; source cadence and reconciliation now exist" since: "2026-09-02" would_change: "accepted deployed-instance evidence supports bounded stream completeness and permits closure; source-only evidence keeps the finding open" default: "the medium grade stands; missing deployed acceptance is recorded as a stalled remediation, and observation remains staffed with completeness pending" default_at: "2026-09-16" graded_by: risk-nexus ruling: RISK-RULING-2026-09-02-A checked_by: "codex/risk-nexus" --- # RISK-F-0011 — qonto-assistant audit.deny stream completeness is not established ## What is true, as reported King's Guard observed real `qonto-assistant` allow and deny events emitted by `audit.AuditLogger` through `CapabilityService`. One deny (`list_transactions` over MCP, `arg_constraint`) arrived with record richness 90 and preserved origin linkage. Gate House accepted that mapping and recorded the qonto lane as staffed for observation. The same return says the `audit.deny` class is load-bearing, and that its **stream completeness is unknown**: - no heartbeat or emission-cadence declaration is published; - no reconciliation view was supplied; - richness 90 describes the received record, not the stream; - no claim is made that every deny was emitted or observed. This is not evidence that an event was suppressed. The reporter assigned no severity and asked this register to intake, grade, and route. Safe evidence named by Gate House: kings-guard revision `9daea96`; source return `23480b81-bc34-4df4-92cc-840fbc8514fd`; Gate House disposition `no_change` at commit `feff576` and `gate-house/docs/conformance/2026-09-02-kings-guard-qonto-live-observation.md`. The owner route `3b9c26a1-ba1a-4189-b439-edd61683aed5` was unread at intake. ## How it was found Live observation, not a self-assessment. King's Guard completed `KG-WP-0003-T06/T07` against the real qonto-assistant lane. Gate House reviewed the return under `GH-WP-0001-T06` and routed the implementation residual here on 2026-09-01 (message `53645a75-0215-4261-a700-f7aedf09e7e8`). ## What a current-source check adds The local lockout does **not** consume the audit stream. `DenyEscalationTracker` is in-process state on the decision path (`CapabilityService` calls `record_deny` / `check` directly; `AuditLogger.emit` is a parallel record). A dropped audit line would not, on today's source, disable qonto-assistant's own Fast Local Loop. What the stream is load-bearing *for* is estate observation. King's Guard already consumes it. Without a cadence declaration or a reconciliation view, that observation can report a received deny and cannot vouch that every deny was emitted. No heartbeat, emission-cadence, or reconciliation artefact was found in qonto-assistant at filing. `fix_tracking` is unset. Taxonomy ownership of an emission-cadence declaration (net-kingdom / info-tech-canon) is a separate residual. This record does not wait on it: depth-one, and one routing exchange has not yet failed. Silence there does not change qonto-assistant's obligation to declare what it emits, or this grade. ## Suggested direction Suggestion, owned by `qonto-assistant`: 1. Publish a heartbeat or emission-cadence declaration for `audit.deny`. 2. Supply a reconciliation view an observer can use to test completeness. 3. Open fix tracking, or reject the obligation in writing so observation stays explicitly incomplete. Risk Nexus owns severity, disclosure, escalation, and review cadence. ## Register ruling — 2026-09-02 `medium` (`I2` × `L3`), public, no escalation. **`I2`: one system's observation of one deny class.** A missed audit.deny does not, on the facts established, authorize a Qonto action or disable the in-process lockout. It leaves estate observation unable to treat the stream as complete. That is confined to the qonto-assistant lane. **`L3`: the gap is the current state of a stream the working set already consumes.** King's Guard reached the stream with no additional step and still could not complete the claim. This is not `L4`: suppression is not established, and the band is scored on the missing completeness evidence, not on an unobserved drop. It is not `L2`: waiting for a special foothold would describe the wrong defect. **No fidelity modifier.** The observer reported completeness as unknown. A later claim that the stream is complete without a cadence or reconciliation view would be the lying-control state; that is not today's headline. **Disclosure `public`.** Reading this does not shorten a path to a defect. It is a missing completeness claim, published as one. Handover to `policy-nexus` is `pending-handover`. **No escalation.** No real-person data exposure, no new outside obligation, no new spend, no failed ownership exchange, and no fourteen-day stall. The dated wait makes that last statement expire. Reasoning: `docs/rulings/2026-09-02-qonto-deny-stream.md`. ## Source remediation reconciled — 2026-09-05 The missing-source statements above describe intake, not the current checkout. QONTO-WP-0005 is finished: cadence, heartbeat lifecycle, instance/sequence fields and an identity-checked reconciliation view now exist. King's Guard's local source-path checks are recorded complete, but KG-WP-0005-T03 waits for an authorized deployed capture. Notice `c6442eef-34fc-46a7-9639-10f2cd6120fc` explicitly requests independent deployed-stream acceptance before closure. [RISK-V-0003](../docs/verifications/2026-09-05-open-findings-source-review.md) records the inspected evidence and bounded acceptance requirements. Status remains open, medium, public, no escalation: deployed completeness is still unknown, with no evidence of suppression or an authorization bypass. The 2026-09-16 default is retained, now describing the actual remaining obligation. ## Reviews - **2026-09-02** — graded from the Gate House intake, the named conformance review, and a current-source check of qonto-assistant. Local lockout is in-process; the emitted deny stream still has no cadence or reconciliation view. Cadence starts at instant. - **2026-09-05** — not clean: Reviewed owner notice, cadence/logger/endpoint and KG-WP-0005; source remediation exists, deployed-instance acceptance remains pending under KG-WP-0005-T03. See RISK-V-0003. Cadence instant → instant; checked again immediately.