gate-house/docs/conformance/2026-09-06-v06-findings-audit.md

Audit — v0.6 review findings against accepted v0.7

Repository: gate-house Project family: NetKingdom security layer Status: complete Version: 1.0 Date: 2026-09-06

Why this exists

On 2026-09-06 the four v0.6 review messages — kings-guard, ops-warden, access-engine (flex-auth), and audit-core — were marked read on the reasoning that v0.7's acceptance closed the round by definition. That is an inference, not a check. A review round is closed when each finding has a disposition someone can point at, not when a later version is accepted over it.

This document does the check. Fifteen findings and two answered questions were raised across the four reviews. Each is traced to text in net-kingdom/canon/standards/security-layer-model_v0.7.md or to a decision record.

Result: all fifteen are dispositioned. None was silently dropped. One consequence of a later decision has since made a v0.7 paragraph stale; it is recorded below and tracked, and it is not a v0.6 finding.

kings-guard

#	Finding	Disposition
1	§1 and §15 announce a human/agent principal separation that §3.4 never states	Written. §3.4 now carries "Two principals, one layer" and the four rules binding the agent principal: no standing credential, tool use is a conduit or an Engine API, agent memory is not a state plane, every agent action reconstructable as the caller's. glas-harness is demarcated as governing session conduct.
2	§13 attributes the containment surface to kings-guard, which §9.2 ruled is not theirs	Reattributed. The §13 row now reads declarer gate-house (estate-wide), owner access-engine + runtime engines, state proposed; §9.2's text says kings-guard is not the declarer.
3	§17's emission-cadence declaration is unowned; offer to draft it	Accepted, then owned. §17 records kings-guard as accepted drafter. Ownership itself was settled later by GH-DEC-2026-004.
nit	§17–§19 are H1 where every other section is H2	Fixed. §17 and §18 are H2; §19 no longer exists (see access-engine 5).

The finding kings-guard called substantive was finding 1, and it was the right call: a rule announced in a change log and absent from the body is the §11 defect turned on the standard itself. It is now in the body.

ops-warden

#	Finding	Disposition
1	§6.4 obligation 1 forbids what obligation 3 blesses; ops-warden's shipped fail-open stance was made a violation	Adopted, near-verbatim. Obligation 1 now reads "…or its declared §9.3 stance for the applicable scope permits proceeding without one and the application of that stance is recorded in place of the decision." The text names the second limb as stricter than silence and credits ops-warden as the reference shape.
2	§6.4 mandates a stance-map register §13 does not implement	Register created. §13.1 "PEP stance-map register" exists; §6.4's closing paragraph records that v0.6 named a register that did not exist and that its first inventory had one row, "which is itself the finding".
rec	The published map MUST equal shipped behaviour	Adopted. Obligation 3 carries the equality requirement with the SHOULD-be-tested clause and ops-warden's own reasoning: a map free to drift is worse than none.

ops-warden's process note — that assented_by carries assent forward across five revisions and could be read as assent to current text — is answered in the v0.7 header comment: "records assent to a BOUNDARY, given at the version named. It is not assent to the current text."

access-engine (flex-auth)

#	Item	Disposition
Q1(a)	§6.4.2 forbids the session-bound allow §9.7.1 permits	Scoped. Obligation 2 is now bounded to replay outside the decision's stated binding and lifetime, and says v0.6 forbade what §9.7.1 permits.
Q1(b)	"Later request" needs a mechanical test	Adopted as normative. Replay is permitted iff the canonical request digest matches and the lifetime holds.
Q1(c)	Deny-caching is outlawed by inference, never ruled on	Ruled explicitly. Negative caching is permitted narrowly: the refusal must be recorded against the request refused, and the cache lifetime declared alongside the stance map.
Q2	A single visibility deadline is the wrong shape for a PDP	Adopted. §9.7.2 requires one deadline at a PEP and a deadline per input class at a PDP, and names the registry-provenance digest and the deadline as one gap seen from two sides.
1	§6.4's stance-map register does not exist	Same disposition as ops-warden 2. §13.1 exists; §6.4 credits both repositories as raising it independently.
2	The companion omits where a stance map is published and omits the inventory obligation	Fixed. SECURITY-COMPANION.md step 3 now says "at a path named in your layer declaration, and register it in statute §13.1".
3	§17 puts the decision-record schema in the wrong layer	Adopted. The row is struck through and moved to access-engine, with a paragraph applying the §2 ownership rule and noting the finding was raised against its own interest.
4	§17–§19 H1 headings	Fixed (see kings-guard nit).
5	§19 grades the document it lives in	Removed. There is no §19 in v0.7; the numbering runs §18 → §20.

audit-core

#	Finding	Disposition
1	Atomicity closes accidental omission, not the adversarial case §9.6 opens with	Adopted as a decomposition table. §9.6 now separates accidental omission (closed by atomicity) from adversarial omission ("detected, after the fact" by cadence and reconciliation), and states the residual explicitly: nothing in the model prevents adversarial omission at a compromised source.
2	Cadence is a SHOULD and is the only control on that residual; rate monitoring inverts the priority for rare events	Both halves adopted. Load-bearing sources MUST declare cadence (attributive SHOULD), and for low-volume load-bearing classes the required form is positive reconciliation or a heartbeat rather than rate monitoring, with GH-WP-0002-T04 named as the reference instance.
3	§3.3's Evidence row states a trade as a property	Adopted. The row reads "a default, not a property; see below", and the following paragraph records that an operation genuinely requiring independent recording before effect is a declared exception raised when needed, not one ruled out by a table cell.

Finding 1 corrected a remedy audit-core had itself proposed, and finding 2 argued against the control it was defending. Both are in the standard in stronger form than they arrived.

What the audit did surface

Not a v0.6 finding — a v0.7 paragraph made stale by a later decision.

§17 closes with "Ownership is proposed, not assigned… Neither has assented." That was true when v0.7 was accepted. It is no longer: GH-DEC-2026-004 assigned the split — info-tech-canon owns the ecosystem-wide EmissionCadenceDeclaration contract, net-kingdom owns the NetKingdom security profile — and both accepted in their own voice (ITC-WP-0018 publishing ITC-EMISSION-CADENCE 0.1 in canon 0.7.0; NK-WP-0035 publishing emission-cadence-security-profile_v0.1.md). A reader of the accepted statute is currently told the estate has not decided something it has.

Tracked as GH-WP-0003-T07. v0.7 is not patched in place.

Method note

The four review messages were re-read from the State Hub rather than from memory, and each finding was checked against the v0.7 text rather than against the change log. §15's change log is a claim about the body; kings-guard's finding 1 is precisely the case where that claim was false, so it cannot be the evidence.