Implement source-backed NetKingdom agent security knowledge pilot

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a101af-e240-7882-a1e3-e37720cbdbea

docs/operational-contracts.md

@@ -0,0 +1,50 @@
+# Operational seams
+
+These are mappings to owner contracts, not replacement APIs. The knowledge CLI
+performs no live operation. Names below are request vocabulary, not authenticated
+facts; owners must bind security-relevant fields before a protected effect.
+
+| Need | Entry / owner | Required context and evidence | Result and failure route |
+| --- | --- | --- | --- |
+| Local edit/test | Repository instructions and task delegation | Explicit task, resolved non-tenant/tenant scope, relevant envelope, tests | Proceed inside actual delegation; uncertainty to delegator. |
+| Find credential route | `warden route find "<need>"`, ops-warden | Need, target, actor, tenant, purpose | Catalog/runbook pointer; absence to routing/construction owner. No credential retrieved. |
+| Request authority | access-engine `POST /v1/check` | Its CheckRequest and verified claims; exact subject/action/resource/context | DecisionEnvelope; verify authentic source, binding and lifetime under PEP contract. Outage follows published PEP stance. |
+| Approval fact | approval-engine claim and consume endpoints | Exact action/target/actor/purpose, validity and supersession | Authenticated claim; consume-before-effect where required; never infer from Statehub prose. |
+| Human question | informed-decision | Concrete memo and requested act | Human answer; no answer is not approval. |
+| Credential lifecycle | secrets-engine owner catalog | Current decision and approval contracts, stage/targets, evidence | Scoped lifecycle/delivery path over custody backend; missing prerequisite refuses effect. |
+| Identity/user facts | key-cape / user-engine | Authenticated principal, actor, runtime identity; scoped membership | Claims, not authorization; unresolved binding to owner/delegator. |
+| Tenant facts | tenant-engine owner APIs | Tenant identifier, lifecycle, role, plan, guardrail source and freshness | PIP facts; outside platform envelope to platform. |
+| Zone membership | zone-engine offline conformance tools | Explicit declaration, manifest/profile and source lineage | Reference membership evidence only; no live zone authorization endpoint. |
+| Construction | ops-mason approved construction plan | Exact covered effects, structure-only accepted exception, target/digest | Bounded build under owner gate; a new effect class needs a new disposition. |
+| Deployment | Owning Railiance repo and current runbook | Exact environment, provenance, human production decision, rollback/evidence | Owner-mediated deployment; no built-in route in this package. |
+| Root | Human root steward | Bounded recovery case, failed lower-scope paths, expiry and independent evidence | ROOT_AUTHORIZATION_REQUIRED; never agent activation. |
+| Posture | kings-guard | Source events plus completeness limitations | Posture/proposal only; no automatic containment. |
+| Adversarial finding | whitehat-security → risk-nexus → defect owner | Approved engagement for live probes, evidence scope and limitations | Finding/disclosure/repair records; fixtures do not prove production. |
+
+## Field mapping
+
+| Emergent reference | Existing estate meaning / mapping limit |
+| --- | --- |
+| `request_id` | Correlation with an exact owner request; not proof of authorization or replay validity. |
+| `principal` | Must distinguish gate-house authority-context principal, actor, and runtime identity; do not flatten them into the model/provider name. |
+| `scope.tenant`, `environment` | Authoritative tenant/resource claims, not caller guesses or paths. |
+| `scope.level` | L0–L4 decision scope; no automatic mapping to SecurityCanon authority modes. |
+| `temperature` | Local change cost/guarantees; not a security-zone ID or runtime environment. |
+| delegation / risk envelope | Reviewed owner policy and bounded facts; no generic runtime representation is declared here. |
+| reference `AUTONOMOUS` | Reference test outcome only; not an estate DecisionEnvelope. |
+| evidence / obligations | Owner-defined claim and effect requirements; free-form explanation cannot substitute for verification. |
+| decision lifetime | Access Engine's `lifetime.not_before` / `expires_at`; exact source and replay verification remain PEP duties. |
+| replay identity | Consumer uses `binding.submitted_request_digest`; enriched `request_digest` is an internal audit identity. |
+| approvals | approval-engine's approval claim plus consume protocol, distinct from the PDP envelope. The composed ActionAuthorization draft is deferred. |
+| negative memory | Reference escalation condition; any operational integration needs a reviewed owner claim/policy mapping. No prompt memory becomes policy. |
+
+Authoritative starting points: gate-house `docs/contracts/authority-context.md`,
+access-engine `docs/decision-record-contract.md` and
+`docs/canonical-request-digest.md`, approval-engine `docs/approval-claim.md` and
+`docs/approval-consumption.md`, secrets-engine `docs/ops-warden-routing-contract.md`.
+Revision-pinned references and digests are in `knowledge/sources.yaml`.
+
+Known documentation contradictions remain findings. Access Engine's decision
+contract has old unsigned-channel prose alongside a newer signature field.
+Do not infer deployed signature enforcement from either paragraph; verify the
+owner's current decision/signature evidence before consuming live decisions.