emergent-security/SCOPE.md

SCOPE

Repository boundary reviewed 2026-10-03. See INTENT.md for purpose and workplans/EMERGENT-WP-0002-agent-security-knowledge-and-netkingdom-integration.md for the active ecosystem integration.

One-liner

Security governance canon, reference decisions, and source-backed NetKingdom security knowledge for coding agents.

Core Idea

Delegate understood decisions within explicit envelopes, escalate unresolved decisions without widening privilege, and keep root human-controlled.

In Scope

• Maintain the versioned canon, agent extract, YAML envelopes and risk scales.
• Maintain the pure Python reference evaluator and decision/governance fixtures.
• Publish source-backed agent knowledge and explicit mappings to existing NetKingdom owners under EMERGENT-WP-0002.

Out of Scope

• Operate a second estate authorization decision point or credential broker.
• Take over another repository's canon, operational routes, or enforcement.
• Treat reference decisions or knowledge loading as operational authority.

Current State

• Canon and reference package: v0.8; Python 3.11+, PyYAML, pytest.
• Knowledge package: v0.2.6 pilot; 14 cards, 24 owners, 69 pinned sources, read-only retrieval CLI, sealed exports and provider adapters.
• Verification: 332 portable tests plus 9 optional real owner-contract tests.
• Informed Decision unsigned adoption draft and native v0.2 orientation runbook; no live submission or execution bridge. See docs/decision-runbook-integration.md.
• Thin pointers installed in four pilot repositories; fresh 0.2.0 pilot evidence and 0.2.1 Codex/Claude scenario evidence are retained. Release 0.2.1 clarifies withdrawn-procedure and missing-event recipients after repeat routing defects. Independent review, context compaction, and broader adoption remain live tasks in EMERGENT-WP-0002.
• No running service, credential issuer or runtime enforcement is provided.

Getting Oriented

• Start with: INTENT.md
• Agent instructions: AGENTS.md
• Workplans: workplans/

Owner reviews now provide scoped doctrine, vocabulary and PDP-boundary evidence for 0.2.1; their institutional/human adoption limits remain explicit. Whitehat reported two loaded-package consistency findings, addressed locally in 0.2.2 with five regression cases. Whitehat review close-out was interrupted by a platform cybersecurity-risk block. The later T03 disposition accepts the scoped offline review and the 0.2.3 library remediation, with disclosed session limits. RISK-F-0015 remains open. Glas model evidence now leaves unreported observed models unknown. Current native continuity requirements remain in GLAS-WP-0012; distribution stays a draft.

Fresh final 0.2.2 Codex and Claude runs each answered 28 scenarios and preserved all substantive authority/evidence boundaries in implementing-worker review; recipient qualifications remain. All four pilot owners supplied documentary feedback on retained scenarios. Grok has retrieval but no completed answer; exact-packet human adoption/admission, native continuity, independent remediation acceptance, current wider pilots and rollout/reach keep EMERGENT-WP-0002 blocked.

Release 0.2.4 reviews Informed Decision's published offline intake at 15c330cc. All 24 owners verify as files. The decisions card records empty registries, no live listener, and no automatic retry of a creating approval without a retained receipt. At that release, the unsigned draft bound digest 025aab4f38246219c924bc94954e70ea0e6e7f72bcaf8d4344cd599602d345c3. See docs/evidence/2026-10-03-024-offline-intake-repin.md. Fresh 0.2.4 Codex, Claude, and Grok fixture probes answered all 28 scenarios; implementing review found no unsafe recommendation, with recipient qualifications retained. See docs/evidence/2026-10-03-024-provider-probes.md. Current-release Claude pilots in the four retained repositories preserve those boundaries, and one Grok session reloaded startup after resume. See docs/evidence/2026-10-03-024-current-release-pilots.md. Codex, Claude, and Grok each resumed after the startup marker changed and refused effect authority. See docs/evidence/2026-10-03-024-provider-resume.md. Compaction, harness proof, owner feedback, human adoption, and fleet reach still block EMERGENT-WP-0002.

Release 0.2.5 re-pins Informed Decision at b4f63732 after that owner recorded local delivery wiring and state-hub d61ba32 accepted governed boolean leaves. Startup on 0.2.4 was withheld once that pin moved. The decisions card records fresh-login/p01 acceptance, the open browser freshness error, empty registries, notification without a URL, local posed evidence, write-back left off, and T08 still waiting on the service account and T05/T06. No listener or submitter route is claimed. At that release, the unsigned draft bound digest 9e186dbd6f2d5eb455bca24db4b03cd866c63c4e94660430dd15f2ca9856215f. 0.2.4 probes, resumes, and pilots stay pinned to that digest. See docs/evidence/2026-10-03-025-informed-decision-repin.md.

Release 0.2.6 keeps that Informed Decision pin and clarifies two routes. A provider switch or compaction reload goes to the session owner, and glas-harness owns that boundary. A question about a live zone authorization endpoint goes to zone-engine. The unsigned draft binds digest 8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02 and is unsubmitted. 0.2.4 probes do not certify this wording. See docs/evidence/2026-10-03-026-route-clarification.md.