From 3493aac2acff227577ded406805a40ad7b765848 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 2 Sep 2026 01:28:30 +0200 Subject: [PATCH] Complete KG-WP-0004-T03: label remaining control-plane strings Every leftover control-plane mention is now a Kubernetes or platform API plane, or an explicit denial that kings-guard is not one. Head-note v0.7 refresh stays T05. Assistant: grok Assistant-Session: 01a05ef1-9e5a-70f2-b0ff-0b05d6b38ae9 --- WORK-RECORDS.md | 2 +- specs/NetKingdomImmuneArchitecture.md | 19 ++++++++++--------- ...004-architecture-layer-vocabulary-sweep.md | 7 ++++++- 3 files changed, 17 insertions(+), 11 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 70d7b40..70d5b75 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -29,7 +29,7 @@ | task | KG-WP-0003-T08 | done | — | workplans/KG-WP-0003-evidence-completeness-and-live-observation.md | | task | KG-WP-0004-T01 | done | — | workplans/KG-WP-0004-architecture-layer-vocabulary-sweep.md | | task | KG-WP-0004-T02 | done | — | workplans/KG-WP-0004-architecture-layer-vocabulary-sweep.md | -| task | KG-WP-0004-T03 | todo | — | workplans/KG-WP-0004-architecture-layer-vocabulary-sweep.md | +| task | KG-WP-0004-T03 | done | — | workplans/KG-WP-0004-architecture-layer-vocabulary-sweep.md | | task | KG-WP-0004-T04 | todo | — | workplans/KG-WP-0004-architecture-layer-vocabulary-sweep.md | | task | KG-WP-0004-T05 | todo | — | workplans/KG-WP-0004-architecture-layer-vocabulary-sweep.md | | intake | KG-IN-0001 | closed | — | intakes/intakes.md | diff --git a/specs/NetKingdomImmuneArchitecture.md b/specs/NetKingdomImmuneArchitecture.md index 1a0fcdc..cc5acb8 100755 --- a/specs/NetKingdomImmuneArchitecture.md +++ b/specs/NetKingdomImmuneArchitecture.md @@ -55,7 +55,8 @@ The architecture aims to preserve the platform's viability by enabling it to: Kings Guard Security is a **recursive adaptive defence architecture**. `kings-guard` is the Staff repository in that architecture: it observes, -judges, and proposes. It is not a control plane and not a decision point. +judges, and proposes. It is not an Engine-layer control plane and not a +decision point. The estate cycle, with layer: @@ -159,7 +160,7 @@ Examples: - namespace; - application domain; - data domain; -- management plane; +- platform management plane (Kubernetes/API operators; not Staff); - sovereign environment. ### 4.3 Subject @@ -700,7 +701,7 @@ This plane establishes nested boundaries. 3. application membrane; 4. workload membrane; 5. data membrane; -6. management membrane; +6. management membrane (platform API/operator plane; not Staff); 7. supply-chain membrane. #### Boundary Controls @@ -739,7 +740,7 @@ posture, and signal, not on this record. - API sentinel; - data-access sentinel; - secret sentinel; -- control-plane sentinel; +- control-plane sentinel (observes the Kubernetes/platform API plane; does not make kings-guard a control plane); - supply-chain sentinel; - application-domain sentinel. @@ -1102,7 +1103,7 @@ The platform immune system owns: - platform availability and integrity; - shared infrastructure; -- cluster and control-plane security; +- cluster and Kubernetes-control-plane security (the platform API plane, not Staff); - common identity and attestation services; - baseline security controls; - supply-chain controls; @@ -1138,8 +1139,8 @@ Different workloads require different strengths of isolation. |---|---|---| | I0 Shared | Logical isolation for low-risk workloads | Namespace, identity and policy boundaries | | I1 Reinforced | Stronger runtime and node separation | Sandboxed runtime, dedicated node pools | -| I2 Dedicated | Tenant-specific control and compute plane | Dedicated cluster or virtual cluster | -| I3 Sovereign | Independent authority and infrastructure boundary | Dedicated account, keys, control plane and operations | +| I2 Dedicated | Tenant-specific Kubernetes control and compute planes (cluster API, not Staff) | Dedicated cluster or virtual cluster | +| I3 Sovereign | Independent authority and infrastructure boundary | Dedicated account, keys, cloud/Kubernetes control plane and operations (tenant's own Engine/platform plane, not kings-guard) | | I4 Air-Gapped | Deliberately disconnected or highly mediated environment | Offline or broker-only exchange | Isolation profile selection considers: @@ -1974,7 +1975,7 @@ Typical characteristics: - dedicated cluster; - dedicated keys; -- dedicated tenant control plane; +- dedicated tenant Kubernetes/cloud control plane (the tenant's platform API plane, not Staff); - tenant-specific recovery environment; - platform federation through signed defensive signals. @@ -2182,7 +2183,7 @@ Deliver: - tenant isolation profiles; - ingress and egress policy; - shared-service brokerage; -- management-plane separation; +- platform management-plane separation (API/operator plane, not Staff); - tenant-specific encryption and secret boundaries. Success condition: diff --git a/workplans/KG-WP-0004-architecture-layer-vocabulary-sweep.md b/workplans/KG-WP-0004-architecture-layer-vocabulary-sweep.md index 1f19d9e..5868168 100644 --- a/workplans/KG-WP-0004-architecture-layer-vocabulary-sweep.md +++ b/workplans/KG-WP-0004-architecture-layer-vocabulary-sweep.md @@ -150,7 +150,7 @@ strings and actuation copy left in place. ```task id: KG-WP-0004-T03 -status: todo +status: done priority: medium state_hub_task_id: "4e97c257-9819-51fc-900b-d632992d096d" ``` @@ -170,6 +170,11 @@ Done when: - a grep for `control plane` / `control-plane` / `Control Plane` in the spec has no unlabeled hit. +**Done 2026-09-02:** Remaining hits are all labelled as Kubernetes/platform +API planes, or as the Staff denial "not an Engine-layer control plane". +I2 "control and compute plane" and management-plane near-misses labelled +the same way. Head note still cites v0.6 / KG-IN-0002 — that rewrite is T05. + ## Task: Correct containment, Phase 5, and the effector contract ```task