coulomb/kings-guard
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Align with Security Layer Model v0.7; review scope vs intent; open KG-WP-0003

Browse source 
The standard is accepted at v0.7 with a working companion. v0.7 wrote the
§3.4 agent-principal rules that v0.6 announced and never wrote — our
finding — and credits kings-guard for it. Our other two findings landed
too: the actuation row is no longer attributed to us, and §17 records
kings-guard as drafter of the emission-cadence declaration.

INTENT.md now carries the declaration in frontmatter (layer: Staff,
conformance_state: blocked-clean) as the companion asks, plus prose in
our own voice. Adopted: the four agent-principal rules; the evidence
doctrine and our obligations under it; containment reframed as proposal
throughout. Direction of Evolution stage 3 rewritten — it described
integrating with effectors to actuate, which §9.2 forbids — and stage 5
now carries the constraint that federated memory may not become a state
plane.

SCOPE.md gains evidence classification, the cadence draft, and
stream-completeness judgment as in-scope; actuation, standing
credentials, and becoming a state plane as explicitly out.

history/2026-08-29-layer-model-v0.7-scope-intent-review.md assesses the
adapted documents against the implementation. The finding: the documents
are now correct and the code has not caught up. Nine gaps, G1-G8 carried
by KG-WP-0003, G9 remaining as KG-IN-0002.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UEtvmYUBP2fDtirJGWn5MW

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4014379@bnt-lap001
Assistant-Session: 4af9e20f-1768-4afc-951b-b507784e382b
This commit is contained in:
tegwick 2026-08-29 14:42:34 +02:00
parent 72c2a42d67
commit 97c7eea1da
5 changed files with 534 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

69
INTENT.md
View file

@ -1,16 +1,32 @@
---
# NetKingdom security layer declaration (statute §11, companion §2).
# Machine-readable form; the prose below is the same claim in our own voice.
# Full contact map and gap records: layer.yaml
layer: Staff
role: null # Engines only
standard: net-kingdom/canon/standards/security-layer-model_v0.7.md
standard_version: "0.7"
declared_by: decisions/decisions.md#KG-DEC-2026-001
declared_at: "2026-08-29"
conformance_state: blocked-clean
principal_kinds: [human, agent]
---
# INTENT
> **Layer: Staff.** *(NetKingdom Security Layer Model — current version
> `net-kingdom/canon/standards/security-layer-model_v0.6.md`, §4 catalog;
> **Layer: Staff.** *(NetKingdom Security Layer Model
> `net-kingdom/canon/standards/security-layer-model_v0.7.md`, **accepted**, §4
> catalog; working form: `net-kingdom/SECURITY-COMPANION.md`;
> ratified by `gate-house/decisions/decisions.md` GH-DEC-2026-001; assented here
> by `decisions/decisions.md` KG-DEC-2026-001 on 2026-08-28, against v0.1.)*
>
> **The machine-readable declaration required by §11 is `layer.yaml`**, checked
> by `scripts/check_layer_conformance.py` and tested in
> **The declaration is the frontmatter above plus `layer.yaml`**, checked by
> `scripts/check_layer_conformance.py` and tested in
> `tests/test_layer_conformance.py`. Prose cannot distinguish a declaration from
> a transcribed review, so the file is authoritative and this note is commentary.
> a transcribed review, so those are authoritative and this note is commentary
> in kings-guard's own voice, as the companion asks.
>
> **Catalog entry (v0.6 §4):** adaptive defence and judgment; observation of
> **Catalog entry (v0.7 §4):** adaptive defence and judgment; observation of
> Staff-reachable sources — identity and secret observation **pending**;
> **proposes** containment, which it does not own.
>
@ -32,6 +48,21 @@
> actuation surface is unowned and held at zero estate-wide, so no argument
> anywhere may assume containment is automatic.
>
> **The agent principal (§3.4).** kings-guard is Staff of the agentic kind, and
> v0.7 binds that principal with four rules this repository offered to accept
> before they were written. They are adopted here as repository invariants:
> **no standing credential** — authority is per task, time-bounded, attributable
> to the principal acted for; **tool use is a §5.2 conduit or an Engine API, and
> there is no third route** — a callable tool means the operation exists, not
> that this actor may invoke it; **agent memory is not a state plane** — immune
> memory, tool-call traces and prompt caches are kings-guard's own and MUST NOT
> become state another layer depends on at runtime unless catalogued as Tooling;
> **every action is reconstructable as the caller's**, bounded by §9.6.
>
> The third rule constrains this repository's own roadmap and is the one to
> watch: federated immune memory (*Direction of Evolution* stage 5) is exactly
> the shape that could drift into a state plane, and it may not.
>
> **Posture contract.** kings-guard **publishes** posture; `gate-house` defines
> its authority meaning; `access-engine` renders it. Posture is not a privilege
> source. The asymmetry is absolute: kings-guard may **reduce** authority,
@ -231,7 +262,7 @@ Kings Guard is:
- an adaptive defence concept and implementation home, in the Staff layer;
- a contract layer for healthy intent, observations, signals, posture, and
effectors;
- a coordination system for detection, containment, recovery, and memory;
- a coordination system for detection, containment **proposal**, recovery, and governed memory;
- a reference architecture for recursive, compartment-aware cloud defense.
---
@ -240,6 +271,9 @@ Kings Guard is:
Kings Guard is not:
- an actuator — it proposes containment and never performs it (§9.2);
- a holder of any standing credential (§3.4 rule 1);
- a state plane for any other layer, its immune memory included (§3.4 rule 3);
- an identity provider;
- an authorization registry;
- a secret store;
@ -257,13 +291,26 @@ The repository should evolve through clear layers:
phenotype, observation, signal, effector, tolerance, inflammation, and
immune memory.
2. **Assessment loop:** provide a minimal service that ingests observations,
evaluates posture against declared intent, and produces typed signals.
3. **Bounded response:** integrate with selected effectors for isolation,
throttling, revocation, or reconstitution under explicit policy.
evaluates posture against declared intent, and produces typed signals —
against **real emitted events**, not fixtures. §12's fourth step
("kings-guard observes it in operation") is the estate's, and it is
unstaffed until this stage is live. Completeness of the stream is part of
the judgment, not an assumption about it (§9.6).
3. **Bounded proposal:** emit containment *requests* — isolation, throttling,
revocation, reconstitution — as typed, authority-bounded proposals to the
engine that renders them. kings-guard never actuates (§9.2); the actuation
surface is an Engine concept and is unowned estate-wide. This stage is
complete when the proposals are well-formed and reconstructable, not when
anything is contained.
4. **Recovery and validation:** prove that known-good restoration can be
coordinated and verified, not merely requested.
5. **Federated memory:** retain reusable defensive knowledge without exposing
tenant-confidential operational detail.
tenant-confidential operational detail — and **without becoming a state
plane**. Under §3.4 rule 3 agent memory may not become state another layer
depends on at runtime. Immune memory may inform kings-guard's own judgment
and may be published as evidence; no engine, PEP, or workload may read it as
an input it depends on. If that ever becomes desirable it is a Tooling
catalog change under §4, not a quiet integration.
---

43
SCOPE.md
View file

@ -23,9 +23,13 @@ platforms.
## Core Idea
`kings-guard` turns declared healthy intent plus observed runtime behavior into
posture judgments, typed security signals, and bounded response requests. It
consumes evidence from identity, authorization, secret, and runtime systems
without replacing those systems' primary authority.
posture judgments, typed security signals, and bounded response **requests**. It
consumes evidence without replacing any system's primary authority, and it
actuates nothing: containment is rendered by an Engine and enforced by a PEP
(statute §9.2).
The one-line test for anything proposed here: **does it judge and propose, or
does it decide and act?** The first is in scope. The second is another layer's.
---
@ -33,19 +37,37 @@ without replacing those systems' primary authority.
- Canonical terminology and contracts for security genome, phenotype,
observation, signal, effector, tolerance, inflammation, and immune memory.
- **Evidence classification** — marking each consumed stream load-bearing or
attributive (§9.6), since the obligations differ.
- **The emission-cadence declaration draft** (§17). kings-guard is its only
consumer and drafts it; Taxonomy owns it. Includes the reconciliation or
heartbeat form required for low-volume load-bearing classes, where rate
monitoring cannot work.
- **Stream-completeness judgment** — treating silence as a signal, and carrying
the resulting doubt in the posture output rather than reporting confidence in
a stream that may be incomplete.
- Reference architecture and boundary documents for adaptive defense in
multi-tenant and agent-active environments.
- Minimal posture-evaluation loop design: ingest observations, compare against
intended healthy state, and emit typed posture/signal results.
- Integration seams to adjacent security systems such as `key-cape`,
`flex-auth`, `secrets-engine`, `ops-warden`, and the Railiance runtime
layers.
- Integration seams to adjacent security systems, taken **through the owning
engine**: `access-engine` (the decision point, currently named `flex-auth`),
`secrets-engine`, `user-engine`, `audit-core`, and the Railiance runtime
layers. `key-cape` and OpenBao are Tooling and are never contacted directly.
- Non-secret evidence, workplans, and repo-operational metadata.
---
## Out of Scope
- **Actuation of any kind.** Reduce authority, require step-up, isolate a
workload — these are authority-changing operations rendered by an Engine and
enforced by a PEP. kings-guard proposes them and never performs them, even
when no engine surface exists to receive the proposal.
- **Holding a standing credential** (§3.4 rule 1).
- **Becoming a state plane for another layer**, immune memory included
(§3.4 rule 3). Immune memory informs kings-guard's judgment and may be
published as evidence; nothing may depend on it at runtime.
- Identity issuance, login, MFA, or token minting.
- Any direct client for a Tooling-layer system (OpenBao, key-cape components,
a database, a cluster) — every such need routes through the owning engine.
@ -53,6 +75,8 @@ without replacing those systems' primary authority.
estate's only decision point.
- "Control plane" as a self-description — that vocabulary belongs to the
Engine layer.
- Claiming that an event's absence from an archive proves it did not happen, or
that a quiet stream is a healthy one (§9.6).
- Authorization policy administration or final resource allow/deny decisions.
- Secret custody, lease issuance, or raw secret-value delivery.
- Infrastructure provisioning, workload deployment, or cluster/platform
@ -72,6 +96,13 @@ without replacing those systems' primary authority.
- The implementation currently evaluates normalized observations and emits
posture/signal results for one bounded pilot lane; it is not an enforcement
service and will not become one.
- `layer.yaml`, `scripts/check_layer_conformance.py` and
`tests/test_layer_conformance.py` make the no-Tooling-client claim executable;
the companion cites them estate-wide as the reference for a repository with no
Tooling contacts at all.
- **Every input is still a fixture.** No real emitted event has reached the
evaluator, so statute §12's fourth step remains unstaffed. Closing that is
`KG-WP-0003`.
---

184
history/2026-08-29-layer-model-v0.7-scope-intent-review.md Normal file
View file

@ -0,0 +1,184 @@
---
title: "Scope vs Intent review against Security Layer Model v0.7"
date: 2026-08-29
repo: kings-guard
author: kings-guard
standard: net-kingdom/canon/standards/security-layer-model_v0.7.md
companion: net-kingdom/SECURITY-COMPANION.md
status: complete
outcome: KG-WP-0003
classification: Public
---
# Scope vs Intent review against Security Layer Model v0.7
The NetKingdom Security Layer Model reached **v0.7, accepted**, with a working
companion at `net-kingdom/SECURITY-COMPANION.md`. `INTENT.md` and `SCOPE.md`
have been adapted to it. This review compares the adapted documents against the
implementation and names what has to change.
The finding in one line: **the documents are now correct and the code has not
caught up.** Every gap below is a place where `INTENT.md` or `SCOPE.md` now
claims something `src/kings_guard/` does not do.
## 1. What the statute settled for this repository
Four of our review findings were adopted across v0.5–v0.7, and two of them
changed what this repository is:
- **Containment left us entirely (§9.2).** Reduce authority, require step-up,
isolate a workload are authority-changing operations, rendered by an Engine
and enforced by a PEP. kings-guard proposes containment and never performs it.
We had been carrying our inability to contain as our own gap; it was never
ours. The actuation surface is unowned estate-wide and held at zero.
- **The agent principal is now bound by four rules (§3.4).** v0.6 announced them
and never wrote them; we found that and offered to assent sight-unseen, and
v0.7 wrote them. They bind this repository harder than any other in the
catalog.
Two obligations arrived with them:
- **kings-guard drafts the emission-cadence declaration (§17)** — as its only
consumer. Ownership stays with Taxonomy; the draft is ours.
- **Load-bearing evidence MUST declare an expected cadence (§9.6)**, and for
low-volume classes — revocations, denials, containment — rate monitoring
cannot work, so the required form is reconciliation or a heartbeat.
Our catalog entry is now: *adaptive defence and judgment; observation of
Staff-reachable sources — identity and secret observation pending; proposes
containment, which it does not own.*
## 2. Where the repository conforms
Worth stating, because the conformance position is unusual and is the thing most
easily lost in a refactor:
- **No Tooling contact of any shape.** Not a §5.1 diagnostic read, not a §5.2
conduit, not a §5.3 declared gap. `dependencies = []` in `pyproject.toml` is
load-bearing for this and must stay empty.
- **Blocked-clean (§11)**, which the statute rules MUST NOT rank below
conforming. Three capabilities sit at zero rather than being taken locally.
- **The claim is executable**, not asserted: `layer.yaml`,
`scripts/check_layer_conformance.py`, `tests/test_layer_conformance.py`. The
companion cites these estate-wide as the reference for a repository with no
Tooling contacts at all.
- **The asymmetry holds in code.** Every `EffectorRequest` carries an explicit
`authority_boundary`; the values in use are `advisory_only` and
`metadata_only`. No path widens authority.
## 3. Gaps — Intent and Scope against the implementation
### G1. Evidence is not classified load-bearing or attributive — §9.6
`ImmuneObservation` carries `source_system` and no evidence class. The statute
attaches different obligations to each: a load-bearing source MUST declare a
cadence, must emit atomically, and its absence is a finding; an attributive
source SHOULD. Without the classification the evaluator cannot know which
obligation applies to a stream, and `SCOPE.md` now claims we classify.
*Necessity:* an evidence class on the observation and on the genome's declared
sources, with the obligation difference expressed in the contract document.
### G2. No emission-cadence declaration exists — §17, and it is ours to draft
`SecurityGenome` has no cadence field. We cannot implement silence-as-signal
without a schema for declared cadence, and inventing a local shape is the exact
drift §17 exists to prevent. The statute has accepted us as drafter.
*Necessity:* draft the declaration against `qonto-assistant` as the one real
source, covering both forms — expected rate for volume classes, and
reconciliation or heartbeat for low-volume load-bearing classes — and hand it to
Taxonomy. It belongs alongside the security genome: a source already declares
its intent there, and expected emission cadence is a claim of the same kind.
### G3. Silence is not a signal — §9.6
`PostureEvaluator.evaluate()` takes one observation and returns one assessment.
It is stateless and has no view of a stream. An event that is never emitted is
never evaluated: no finding, no signal, no posture change, and the last posture
stands. Suppression therefore biases posture **optimistic**, silently. This is
the failure the statute names, reproduced one layer up in the consumer.
*Necessity:* a stream-level evaluation path alongside the per-observation one —
cadence comparison for volume classes, reconciliation or heartbeat absence for
rare ones — emitting a finding when the stream itself goes quiet.
### G4. Confidence measures the record, not the stream — §9.6
`confidence_score` starts at 70 and rises with `policy_version`, `latency_ms`
and `resource_scope`. It is a measure of field richness in the record we
received. A perfectly-formed observation drawn from a 90%-suppressed stream
scores 85. The score cannot express the doubt the statute now requires us to
carry.
*Necessity:* separate completeness from richness. Posture output should carry a
stream-completeness dimension that degrades when cadence is unmet or a heartbeat
is missing, and `PostureAssessment` should be able to say *this judgment rests
on a stream I cannot vouch for.*
### G5. Nothing prevents immune memory becoming a state plane — §3.4 rule 3
`ImmuneMemoryEntry` exists with `confidentiality: str = "non-secret"` and no
rule about who may depend on it. `INTENT.md` stage 5 (federated memory) is
exactly the shape that could drift into a state plane, and the statute forbids
it unless catalogued as Tooling.
*Necessity:* state the constraint in `specs/ImmuneContracts.md` — immune memory
informs kings-guard's judgment and may be published as evidence; no engine, PEP
or workload may read it as a runtime input — and assert it in a test so the
drift is caught rather than argued.
### G6. Proposals carry no reference to what they were rendered against — §9.2
`EffectorRequest` has `target_system`, `action`, `authority_boundary`, `reason`,
`requires_human_approval`. §9.2 rules that a containment action is a decision
record, not a side channel. Our proposals are the input to such a record and
carry no request identity, so a proposal cannot be reconstructed against the
observation that produced it once it leaves this repository.
*Necessity:* carry the originating observation and signal identity on the
request, so the eventual decision record can name what it was rendered for.
### G7. The agent-principal rules are documented and unverified — §3.4
All four are now claimed in `INTENT.md`. None is checked. Rule 1 (no standing
credential) is mechanically checkable in this repository the same way the
no-Tooling-client claim is; rule 3 follows from G5.
*Necessity:* extend `scripts/check_layer_conformance.py` to cover what can be
checked, and record honestly which rules are assertion rather than test.
### G8. §12's fourth step is unstaffed — the pilot is fixture-only
Every input is a hand-built fixture. Ten tests pass and none has met a real
event. The statute records this as disclosed, and §19's verdict — the estate can
propose and decide but cannot watch or act — names us as the watching half.
Nothing blocks it: `qonto-assistant` publishes its own genome and audit stream,
needs no engine in the path, and its genome has not drifted since it was
written. This is the one substantial lane no engine gap touches.
*Necessity:* ingest real emitted events from `qonto-assistant`, confirm or
correct the observation mapping, keep the output advisory.
### G9. Residual vocabulary — KG-IN-0002
`specs/NetKingdomImmuneArchitecture.md` predates the model and still uses
"control plane" across ~1900 lines. A scoping note heads the file; the body is
unadapted. Now also carries the stale stage-3 framing that §9.2 corrected.
## 4. What is deliberately not being done
- **No engine gap is being worked around.** Identity and secret observation stay
at zero. The blocked-clean position is the point, not an inconvenience.
- **No actuation.** G6 makes proposals reconstructable; it does not make them
actionable, and nothing here moves toward an effector that acts.
- **No Tooling client**, including for live ingest in G8 — `qonto-assistant`
is a governed domain assistant publishing its own stream, not a Tooling row.
## 5. Disposition
`KG-WP-0003` carries G1–G8. G9 remains `KG-IN-0002`. The ordering is forced:
G2 unblocks G3, and G3 unblocks G4; G1 is a prerequisite for all three because
the obligation differs by evidence class. G8 is independent and is what makes
the rest testable against something real.

12
layer.yaml
View file

@ -1,6 +1,6 @@
# kings-guard — NetKingdom security layer declaration
#
# Framework: net-kingdom/canon/standards/security-layer-model_v0.6.md
# Framework: net-kingdom/canon/standards/security-layer-model_v0.7.md
# Assent: decisions/decisions.md KG-DEC-2026-001 (kings-guard's own voice, §11)
# Validate: python3 scripts/check_layer_conformance.py
#
@ -15,7 +15,7 @@
schema_version: "0.1"
framework: netkingdom-security-layer-model
standard_version: "0.6"
standard_version: "0.7"
repository: kings-guard
layer: staff
declared_by: decisions/decisions.md#KG-DEC-2026-001
@ -24,6 +24,14 @@ declared_at: "2026-08-29"
# §4 catalog entry, transcribed so drift between the catalog and this file is
# visible. The standard is authoritative for the row; this records what we
# understand ourselves to have been assigned.
# §3.4 — the four rules binding the agent principal. kings-guard offered to
# assent to these sight-unseen before they were written into v0.7.
agent_principal_rules:
no_standing_credential: true
tool_use_shapes: ["5.2-conduit", "engine-api"]
memory_is_not_a_state_plane: true
reconstructable_as_caller: true
catalog_entry:
owns:
- adaptive defence and judgment

245
workplans/KG-WP-0003-evidence-completeness-and-live-observation.md Normal file
View file

@ -0,0 +1,245 @@
---
id: KG-WP-0003
type: workplan
title: "Evidence completeness and live observation"
domain: infotech
repo: kings-guard
status: ready
owner: kings-guard
topic_slug: netkingdom
created: "2026-08-29"
updated: "2026-08-29"
source_review: history/2026-08-29-layer-model-v0.7-scope-intent-review.md
standard: net-kingdom/canon/standards/security-layer-model_v0.7.md
---
# Evidence completeness and live observation
Close the gap between what `INTENT.md` and `SCOPE.md` now claim under Security
Layer Model v0.7 and what `src/kings_guard/` actually does. Carries G1–G8 of
`history/2026-08-29-layer-model-v0.7-scope-intent-review.md`.
Two things are being fixed. The repository consumes evidence and treats a quiet
stream as a healthy one, which the statute now forbids (§9.6). And statute §12's
fourth step — *kings-guard observes it in operation* — is unstaffed, because
every input is a fixture.
## Boundaries this workplan does not cross
- **No actuation.** kings-guard proposes containment and never performs it
(§9.2). T06 makes proposals reconstructable; it does not make them act.
- **No Tooling contact.** `dependencies = []` stays empty; `make check-layer`
must stay green on every task. `qonto-assistant` publishes its own stream and
is not a Tooling row, so T07 needs no engine in the path.
- **No engine gap worked around.** Identity and secret observation stay at zero.
## Dependency order
```text
T01 evidence classification
-> T02 emission-cadence declaration (draft, handed to Taxonomy)
-> T03 stream-completeness evaluation
-> T04 completeness in the posture output
T05 immune memory is not a state plane (independent)
T06 proposals carry their origin (independent)
T07 live observation (independent; makes the rest real)
T08 agent-principal conformance checks (after T05)
```
## Task: Classify consumed evidence load-bearing or attributive
```task
id: KG-WP-0003-T01
status: todo
priority: high
```
Statute §9.6 attaches different obligations to each class, and the repository
currently records neither. `ImmuneObservation` carries `source_system` and no
class; `SecurityGenome` declares no sources at all.
Done when:
- the evidence class is expressible on a declared source and on an observation;
- `specs/ImmuneContracts.md` states the obligation difference — a load-bearing
source MUST declare a cadence, an attributive source SHOULD — and states that
the class is the source's declaration, not kings-guard's inference;
- the `qonto-assistant` fixture declares a class for its audit stream, with the
reasoning recorded;
- tests cover both classes.
## Task: Draft the emission-cadence declaration and hand it to Taxonomy
```task
id: KG-WP-0003-T02
status: todo
priority: high
```
Statute §17 requires the artifact and records kings-guard as its drafter, being
its only consumer. Ownership stays with Taxonomy. Inventing a local shape is the
drift §17 exists to prevent, so this is a draft for handover, not an internal
schema.
Must cover both forms, because one does not substitute for the other:
- an **expected rate** for volume classes;
- **reconciliation or a heartbeat** for low-volume load-bearing classes —
revocations, denials, containment actions — where rate monitoring cannot work
because a suppressed month is indistinguishable from a quiet one. The required
property is a positive claim that can itself go missing.
Done when:
- the draft lives in `specs/` and is written against `qonto-assistant` as the
one real source;
- it explains where the declaration belongs — alongside the security genome, on
the argument that expected cadence is a claim of intent like the rest of the
genome — and why;
- `GH-WP-0002-T04` is referenced as the reference instance for the heartbeat
form;
- it is sent to gate-house and to the Taxonomy repositories for ownership, and
the handover is recorded.
## Task: Evaluate the stream, not only the observation
```task
id: KG-WP-0003-T03
status: todo
priority: high
```
`PostureEvaluator.evaluate()` is stateless and per-observation. An event that is
never emitted is never evaluated, so the last posture stands and suppression
biases posture optimistic. Silence must become a finding in its own right.
Done when:
- a stream-level evaluation path exists alongside the per-observation one;
- an unmet declared cadence produces a finding;
- a missing heartbeat, or a reconciliation divergence between the source's own
state transitions and the evidence count per class, produces a finding;
- the findings are distinguishable from content findings — the stream observed,
not its contents;
- no Tooling contact is introduced; the source publishes its own stream.
## Task: Carry stream completeness in the posture output
```task
id: KG-WP-0003-T04
status: todo
priority: high
```
`confidence_score` starts at 70 and rises with field richness of the record
received. It measures the record, never the stream: a well-formed observation
from a 90%-suppressed stream scores 85. The judgment must be able to say *this
rests on a stream I cannot vouch for.*
Done when:
- completeness is separated from richness in `PostureAssessment`;
- an unmet cadence or missing heartbeat degrades the completeness dimension;
- the rationale text says so in words, not only in a number;
- a posture derived from an incomplete stream can never read as more trustworthy
than one derived from a complete one.
## Task: State and test that immune memory is not a state plane
```task
id: KG-WP-0003-T05
status: todo
priority: medium
```
Statute §3.4 rule 3: agent memory, tool-call traces and prompt caches MUST NOT
become state another layer depends on at runtime unless catalogued as Tooling.
`ImmuneMemoryEntry` has no such rule, and `INTENT.md` stage 5 (federated memory)
is exactly the shape that could drift into one.
Done when:
- `specs/ImmuneContracts.md` states it: immune memory informs kings-guard's own
judgment and may be published as evidence; no engine, PEP or workload may read
it as a runtime input, and making it one is a §4 Tooling catalog change;
- a test asserts the constraint rather than leaving it to prose;
- the constraint is reflected in the `Direction of Evolution` stage-5 entry.
## Task: Make containment proposals reconstructable to their origin
```task
id: KG-WP-0003-T06
status: todo
priority: medium
```
§9.2 rules that a containment action is a decision record, not a side channel.
`EffectorRequest` names a target and an action and carries no reference to what
produced it, so once a proposal leaves this repository it cannot be tied back to
the observation that caused it.
Done when:
- an effector request carries the originating observation and signal identity;
- the eventual decision record can name what the proposal was rendered for;
- `docs/AdjacentSystemBoundary.md` states the expectation on the receiving side;
- the authority boundary remains explicit and no value widens authority.
## Task: Observe qonto-assistant in operation
```task
id: KG-WP-0003-T07
status: todo
priority: high
```
Statute §12's fourth step is aspiration until this is done, and §19's verdict
names kings-guard as the watching half of *can propose and decide but cannot
watch or act*. Every input today is a hand-built fixture; ten tests pass and
none has met a real event.
Nothing blocks it. `qonto-assistant` publishes its own genome record and audit
stream, needs no engine in the path, and its genome has not drifted since it was
written.
Done when:
- real emitted audit events from `qonto-assistant` reach the evaluator;
- the observation mapping is confirmed against real events or corrected, and the
correction is reported back to `qonto-assistant`;
- output stays advisory — posture hints and metadata-only evidence, nothing that
actuates;
- the fixture is retained as a regression case rather than deleted;
- gate-house is told that step four is staffed, with what was found.
## Task: Check the agent-principal rules that can be checked
```task
id: KG-WP-0003-T08
status: todo
priority: medium
```
All four §3.4 rules are now claimed in `INTENT.md` and none is verified. The
no-Tooling-client claim showed the pattern: a claim in prose becomes a claim in
a test, and the test carries the reason.
Done when:
- `scripts/check_layer_conformance.py` covers what is mechanically checkable —
at minimum rule 1, no standing credential held in the repository or its
configuration;
- rule 3 is covered by T05;
- rules that remain assertion rather than test are recorded as such in
`layer.yaml`, honestly, rather than implied to be checked;
- `make check-layer` stays green.
## Success criteria
1. Every task above is `done`.
2. `make test` and `make check-layer` both pass.
3. `pyproject.toml` still declares `dependencies = []`.
4. `INTENT.md` and `SCOPE.md` claim nothing the implementation does not do.
5. The emission-cadence draft has been handed to Taxonomy and the handover
recorded.
6. gate-house has been told that §12's fourth step is staffed.