gate-house/docs/contracts/posture-findings-return.md

Posture and findings return-path contract

Doctrine owner: gate-house Posture publisher: kings-guard Decision point: access-engine Assurance executor: whitehat-security Finding triage: risk-nexus Status: normative for GH-WP-0001-T06 Version: posture-findings-return.v1 Date: 2026-09-01 Agreement basis: kings-guard KG-DEC-2026-001 and KG-WP-0003

1. Agreed boundary

The existing agreement is:

kings-guard publishes non-deterministic posture
Gate House defines posture's authority meaning and restrictive asymmetry
access-engine deterministically renders a decision
the responsible Engine or ops-warden performs an authorized response

Posture may reduce authority, require stronger authorization, or request containment. It never creates or widens authority. A containment proposal is not an authorization and kings-guard never bypasses an Engine to act on Tooling.

2. Posture envelope

A posture input offered for authority use must make these facts expressible:

posture_id: <stable id>
subject:
  kind: actor | runtime | resource | tenant | environment
  id: <canonical id>
assessment: HEALTHY | DEGRADED | SUSPICIOUS | CONTAIN | BLOCKED
source: kings-guard
observed_at: <RFC 3339 UTC>
expires_at: <RFC 3339 UTC>
evidence_refs: []
stream_completeness:
  status: complete | degraded | unknown
  reason: <value-safe explanation>
rationale: <value-safe explanation>

This is a logical contract, not a kings-guard wire schema. Confidence or record richness may accompany it, but cannot override unknown or degraded stream completeness and cannot grant authority.

Access-engine records the posture identifier, freshness, and policy version that interpreted it. Unknown, missing, expired, or incomplete posture follows a declared restrictive stance; it does not fall back to extra authority.

3. Observation and proposal linkage

A kings-guard finding or containment proposal carries:

• originating observation identifier;
• emitted signal/posture identifier;
• affected subject and target;
• evidence-stream completeness state;
• requested restrictive direction;
• no credential, secret value, or direct actuation instruction.

The eventual access-engine decision and authorized response retain those origin references. This makes a containment decision reconstructable without turning the proposal into authority.

4. Findings return

King's Guard returns these classes to Gate House:

• an invariant does not match observed behavior;
• an implementation supplies posture in a form that cannot be interpreted without widening or ambiguity;
• a load-bearing evidence stream is silent, divergent, stale, or incomplete;
• a required live observation lane does not exist;
• a doctrine claim is recomputable and therefore misclassified as posture;
• a conformance result exposes a missing or untestable doctrine rule.

The durable transport is a State Hub inbox message:

Subject: [GH-POSTURE] <finding-class> <subject>@<revision-or-time>
Body: posture/signal/observation ids, safe evidence references, completeness,
      affected invariant, current restriction, and requested doctrine action

5. Gate House disposition

Gate House classifies the returned item without regrading security severity:

Finding shape	Gate House action
Doctrine correct; implementation failed	Cross-reference risk-nexus/owner record; no foreign task is created here.
Doctrine ambiguous or contradictory	Create or promote a Gate House intake, decision, contract revision, or workplan.
Posture lane or observation mechanism missing	Return to kings-guard as its owning gap; mark affected conformance claim pending.
Deterministic/recomputable property called posture	Move the criterion toward its owning Engine; do not create a second grader.
Assurance specification incomplete	Revise the Gate House target and return the new version to whitehat-security.

Every disposition replies with the resulting Gate House record identifiers or no_change plus rationale. Silence is not a disposition.

6. Loop closure

The loop is considered staffed, not necessarily green, when:

1. whitehat-security has an executable target and reports every outcome;
2. kings-guard can observe at least one live lane and reports stream completeness separately from record richness;
3. access-engine can bind posture to the decision it influenced;
4. Gate House records doctrine disposition and returns identifiers;
5. implementation remediation remains with the owning repository via risk-nexus.

KG-WP-0003-T06 and T07 are the kings-guard work that makes origin linkage and live observation real. Until those tasks report completion, the corresponding lanes are declared gaps rather than assumed capabilities.