Implement KG-WP-0002 posture pilot scaffold

workplans/KG-WP-0002-canonical-immune-contracts-and-posture-pilot.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Canonical immune contracts and first posture pilot"
 domain: infotech
 repo: kings-guard
-status: active
+status: finished
 owner: codex
 topic_slug: netkingdom
 created: "2026-07-23"
@@ -59,7 +59,7 @@ T01 canonical contracts
 
 ```task
 id: KG-WP-0002-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "9982a3b4-1e65-493a-9b61-322f23d4fd2d"
 ```
@@ -75,11 +75,19 @@ Done when:
 - producer/consumer expectations are named for each contract;
 - the contracts are usable without requiring one particular product stack.
 
+**Done 2026-07-23:** Added [ImmuneContracts.md](/home/worsch/kings-guard/specs/ImmuneContracts.md),
+which defines the v0.1 contract layer for `security_genome`,
+`immune_observation`, `security_phenotype`, `posture_assessment`,
+`immune_signal`, `effector_request`, `tolerance`, `inflammation`, and
+`immune_memory_entry`. The doc names producer/consumer expectations for every
+contract and keeps the field set intentionally implementation-neutral. The
+matching reference dataclasses live in `src/kings_guard/contracts.py`.
+
 ## Task: Write adjacent-system boundary contract
 
 ```task
 id: KG-WP-0002-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "0c44035e-b1b8-4f5d-8a6c-e6514b4bc897"
 ```
@@ -94,11 +102,20 @@ Done when:
 - `kings-guard` inputs, outputs, and non-goals are named per system;
 - tenant-isolation and non-secret evidence rules are captured.
 
+**Done 2026-07-23:** Added
+[AdjacentSystemBoundary.md](/home/worsch/kings-guard/docs/AdjacentSystemBoundary.md),
+which records the primary authority, evidence inputs, bounded outputs, and
+non-goals for `key-cape`, `flex-auth`, `secrets-engine`,
+`railiance-platform` / OpenBao, `ops-warden`, Railiance runtime layers,
+`state-hub`, and the governed domain-assistant pattern represented by
+`qonto-assistant`. The document also names the cross-system rules for
+tenant isolation and metadata-only evidence handling.
+
 ## Task: Scaffold a minimal posture loop
 
 ```task
 id: KG-WP-0002-T03
-status: todo
+status: done
 priority: high
 state_hub_task_id: "c88a7da6-a9ff-4bd9-ba47-7c199321666b"
 ```
@@ -114,11 +131,34 @@ Done when:
   signal;
 - tests or fixture-driven validation prove the contract shape is stable.
 
+**Done 2026-07-23:** Added the first executable scaffold:
+
+- `pyproject.toml`, `Makefile`, `README.md`, `AGENTS.md`, and `.gitignore`
+  updates;
+- `src/kings_guard/` with contract dataclasses, a qonto audit-event adapter,
+  fixture loader, posture evaluator, and CLI demo runner;
+- `tests/` with fixture-driven tests for normalization, JSON-safe contract
+  serialization, posture assessment, and bounded signal emission.
+
+The sample end-to-end path is: qonto audit event fixture ->
+`observation_from_audit_event()` -> `PostureEvaluator.evaluate()` ->
+advisory `posture_hint` signal. Verified in this shell with:
+
+- `git diff --check`
+- `python3 -m pytest -q` -> 5 passed
+- `python3 -m compileall src tests`
+- `PYTHONPATH=src python3 -m kings_guard.main --pilot qonto-assistant`
+
+`ruff` is declared in the repo's dev dependencies and lint command, but the
+current shell lacked both `pip` and the `ruff` module, so source verification
+in this session used tests + compile + demo execution rather than the lint
+step.
+
 ## Task: Choose and specify the first pilot lane
 
 ```task
 id: KG-WP-0002-T04
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "77e1dc69-9902-4381-8028-ce1cfac7e9d5"
 ```
@@ -136,3 +176,14 @@ Done when:
 - the pilot can run without granting `kings-guard` secret, identity, or final
   authorization authority;
 - bounded-response and rollback expectations are documented.
+
+**Done 2026-07-23:** Selected `qonto-assistant` as the first pilot lane and
+documented it in
+[QontoAssistantPosturePilot.md](/home/worsch/kings-guard/docs/pilots/QontoAssistantPosturePilot.md).
+This deliberately overrides the original preference order because
+`qonto-assistant` already exposes all three things the first pilot needs: a
+real genome record, a real audit stream, and a real local fast loop. The pilot
+flow is concrete and bounded: `kings-guard` consumes normalized observation
+evidence, emits an advisory-only posture hint, and may request metadata-only
+incident evidence in `state-hub`; it does not gain final authorization,
+identity, or secret-custody authority.