coulomb/kings-guard
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Complete KG-WP-0004-T03: label remaining control-plane strings

Browse source 
Every leftover control-plane mention is now a Kubernetes or platform API
plane, or an explicit denial that kings-guard is not one. Head-note v0.7
refresh stays T05.

Assistant: grok
Assistant-Session: 01a05ef1-9e5a-70f2-b0ff-0b05d6b38ae9
This commit is contained in:
tegwick 2026-09-02 01:28:30 +02:00
parent 569def5584
commit 3493aac2ac
3 changed files with 17 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WORK-RECORDS.md
View file

@ -29,7 +29,7 @@
| task | KG-WP-0003-T08 | done | — | workplans/KG-WP-0003-evidence-completeness-and-live-observation.md |
| task | KG-WP-0004-T01 | done | — | workplans/KG-WP-0004-architecture-layer-vocabulary-sweep.md |
| task | KG-WP-0004-T02 | done | — | workplans/KG-WP-0004-architecture-layer-vocabulary-sweep.md |
| task | KG-WP-0004-T03 | todo | — | workplans/KG-WP-0004-architecture-layer-vocabulary-sweep.md |
| task | KG-WP-0004-T03 | done | — | workplans/KG-WP-0004-architecture-layer-vocabulary-sweep.md |
| task | KG-WP-0004-T04 | todo | — | workplans/KG-WP-0004-architecture-layer-vocabulary-sweep.md |
| task | KG-WP-0004-T05 | todo | — | workplans/KG-WP-0004-architecture-layer-vocabulary-sweep.md |
| intake | KG-IN-0001 | closed | — | intakes/intakes.md |

19
specs/NetKingdomImmuneArchitecture.md
View file

@ -55,7 +55,8 @@ The architecture aims to preserve the platform's viability by enabling it to:
Kings Guard Security is a **recursive adaptive defence architecture**.
`kings-guard` is the Staff repository in that architecture: it observes,
judges, and proposes. It is not a control plane and not a decision point.
judges, and proposes. It is not an Engine-layer control plane and not a
decision point.
The estate cycle, with layer:
@ -159,7 +160,7 @@ Examples:
- namespace;
- application domain;
- data domain;
- management plane;
- platform management plane (Kubernetes/API operators; not Staff);
- sovereign environment.
### 4.3 Subject
@ -700,7 +701,7 @@ This plane establishes nested boundaries.
3. application membrane;
4. workload membrane;
5. data membrane;
6. management membrane;
6. management membrane (platform API/operator plane; not Staff);
7. supply-chain membrane.
#### Boundary Controls
@ -739,7 +740,7 @@ posture, and signal, not on this record.
- API sentinel;
- data-access sentinel;
- secret sentinel;
- control-plane sentinel;
- control-plane sentinel (observes the Kubernetes/platform API plane; does not make kings-guard a control plane);
- supply-chain sentinel;
- application-domain sentinel.
@ -1102,7 +1103,7 @@ The platform immune system owns:
- platform availability and integrity;
- shared infrastructure;
- cluster and control-plane security;
- cluster and Kubernetes-control-plane security (the platform API plane, not Staff);
- common identity and attestation services;
- baseline security controls;
- supply-chain controls;
@ -1138,8 +1139,8 @@ Different workloads require different strengths of isolation.
|---|---|---|
| I0 Shared | Logical isolation for low-risk workloads | Namespace, identity and policy boundaries |
| I1 Reinforced | Stronger runtime and node separation | Sandboxed runtime, dedicated node pools |
| I2 Dedicated | Tenant-specific control and compute plane | Dedicated cluster or virtual cluster |
| I3 Sovereign | Independent authority and infrastructure boundary | Dedicated account, keys, control plane and operations |
| I2 Dedicated | Tenant-specific Kubernetes control and compute planes (cluster API, not Staff) | Dedicated cluster or virtual cluster |
| I3 Sovereign | Independent authority and infrastructure boundary | Dedicated account, keys, cloud/Kubernetes control plane and operations (tenant's own Engine/platform plane, not kings-guard) |
| I4 Air-Gapped | Deliberately disconnected or highly mediated environment | Offline or broker-only exchange |
Isolation profile selection considers:
@ -1974,7 +1975,7 @@ Typical characteristics:
- dedicated cluster;
- dedicated keys;
- dedicated tenant control plane;
- dedicated tenant Kubernetes/cloud control plane (the tenant's platform API plane, not Staff);
- tenant-specific recovery environment;
- platform federation through signed defensive signals.
@ -2182,7 +2183,7 @@ Deliver:
- tenant isolation profiles;
- ingress and egress policy;
- shared-service brokerage;
- management-plane separation;
- platform management-plane separation (API/operator plane, not Staff);
- tenant-specific encryption and secret boundaries.
Success condition:

7
workplans/KG-WP-0004-architecture-layer-vocabulary-sweep.md
View file

@ -150,7 +150,7 @@ strings and actuation copy left in place.
```task
id: KG-WP-0004-T03
status: todo
status: done
priority: medium
state_hub_task_id: "4e97c257-9819-51fc-900b-d632992d096d"
```
@ -170,6 +170,11 @@ Done when:
- a grep for `control plane` / `control-plane` / `Control Plane` in the
spec has no unlabeled hit.
**Done 2026-09-02:** Remaining hits are all labelled as Kubernetes/platform
API planes, or as the Staff denial "not an Engine-layer control plane".
I2 "control and compute plane" and management-plane near-misses labelled
the same way. Head note still cites v0.6 / KG-IN-0002 — that rewrite is T05.
## Task: Correct containment, Phase 5, and the effector contract
```task