From 97c7eea1da9857b160d7f9933279405d19284749 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 29 Aug 2026 14:42:34 +0200 Subject: [PATCH] Align with Security Layer Model v0.7; review scope vs intent; open KG-WP-0003 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The standard is accepted at v0.7 with a working companion. v0.7 wrote the §3.4 agent-principal rules that v0.6 announced and never wrote — our finding — and credits kings-guard for it. Our other two findings landed too: the actuation row is no longer attributed to us, and §17 records kings-guard as drafter of the emission-cadence declaration. INTENT.md now carries the declaration in frontmatter (layer: Staff, conformance_state: blocked-clean) as the companion asks, plus prose in our own voice. Adopted: the four agent-principal rules; the evidence doctrine and our obligations under it; containment reframed as proposal throughout. Direction of Evolution stage 3 rewritten — it described integrating with effectors to actuate, which §9.2 forbids — and stage 5 now carries the constraint that federated memory may not become a state plane. SCOPE.md gains evidence classification, the cadence draft, and stream-completeness judgment as in-scope; actuation, standing credentials, and becoming a state plane as explicitly out. history/2026-08-29-layer-model-v0.7-scope-intent-review.md assesses the adapted documents against the implementation. The finding: the documents are now correct and the code has not caught up. Nine gaps, G1-G8 carried by KG-WP-0003, G9 remaining as KG-IN-0002. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01UEtvmYUBP2fDtirJGWn5MW Assistant: claude-code Assistant-Model: opus Assistant-Process: 4014379@bnt-lap001 Assistant-Session: 4af9e20f-1768-4afc-951b-b507784e382b --- INTENT.md | 69 ++++- SCOPE.md | 43 ++- ...29-layer-model-v0.7-scope-intent-review.md | 184 +++++++++++++ layer.yaml | 12 +- ...dence-completeness-and-live-observation.md | 245 ++++++++++++++++++ 5 files changed, 534 insertions(+), 19 deletions(-) create mode 100644 history/2026-08-29-layer-model-v0.7-scope-intent-review.md create mode 100644 workplans/KG-WP-0003-evidence-completeness-and-live-observation.md diff --git a/INTENT.md b/INTENT.md index b0fcb43..4caa01b 100644 --- a/INTENT.md +++ b/INTENT.md @@ -1,16 +1,32 @@ +--- +# NetKingdom security layer declaration (statute §11, companion §2). +# Machine-readable form; the prose below is the same claim in our own voice. +# Full contact map and gap records: layer.yaml +layer: Staff +role: null # Engines only +standard: net-kingdom/canon/standards/security-layer-model_v0.7.md +standard_version: "0.7" +declared_by: decisions/decisions.md#KG-DEC-2026-001 +declared_at: "2026-08-29" +conformance_state: blocked-clean +principal_kinds: [human, agent] +--- + # INTENT -> **Layer: Staff.** *(NetKingdom Security Layer Model — current version -> `net-kingdom/canon/standards/security-layer-model_v0.6.md`, §4 catalog; +> **Layer: Staff.** *(NetKingdom Security Layer Model +> `net-kingdom/canon/standards/security-layer-model_v0.7.md`, **accepted**, §4 +> catalog; working form: `net-kingdom/SECURITY-COMPANION.md`; > ratified by `gate-house/decisions/decisions.md` GH-DEC-2026-001; assented here > by `decisions/decisions.md` KG-DEC-2026-001 on 2026-08-28, against v0.1.)* > -> **The machine-readable declaration required by §11 is `layer.yaml`**, checked -> by `scripts/check_layer_conformance.py` and tested in +> **The declaration is the frontmatter above plus `layer.yaml`**, checked by +> `scripts/check_layer_conformance.py` and tested in > `tests/test_layer_conformance.py`. Prose cannot distinguish a declaration from -> a transcribed review, so the file is authoritative and this note is commentary. +> a transcribed review, so those are authoritative and this note is commentary +> in kings-guard's own voice, as the companion asks. > -> **Catalog entry (v0.6 §4):** adaptive defence and judgment; observation of +> **Catalog entry (v0.7 §4):** adaptive defence and judgment; observation of > Staff-reachable sources — identity and secret observation **pending**; > **proposes** containment, which it does not own. > @@ -32,6 +48,21 @@ > actuation surface is unowned and held at zero estate-wide, so no argument > anywhere may assume containment is automatic. > +> **The agent principal (§3.4).** kings-guard is Staff of the agentic kind, and +> v0.7 binds that principal with four rules this repository offered to accept +> before they were written. They are adopted here as repository invariants: +> **no standing credential** — authority is per task, time-bounded, attributable +> to the principal acted for; **tool use is a §5.2 conduit or an Engine API, and +> there is no third route** — a callable tool means the operation exists, not +> that this actor may invoke it; **agent memory is not a state plane** — immune +> memory, tool-call traces and prompt caches are kings-guard's own and MUST NOT +> become state another layer depends on at runtime unless catalogued as Tooling; +> **every action is reconstructable as the caller's**, bounded by §9.6. +> +> The third rule constrains this repository's own roadmap and is the one to +> watch: federated immune memory (*Direction of Evolution* stage 5) is exactly +> the shape that could drift into a state plane, and it may not. +> > **Posture contract.** kings-guard **publishes** posture; `gate-house` defines > its authority meaning; `access-engine` renders it. Posture is not a privilege > source. The asymmetry is absolute: kings-guard may **reduce** authority, @@ -231,7 +262,7 @@ Kings Guard is: - an adaptive defence concept and implementation home, in the Staff layer; - a contract layer for healthy intent, observations, signals, posture, and effectors; -- a coordination system for detection, containment, recovery, and memory; +- a coordination system for detection, containment **proposal**, recovery, and governed memory; - a reference architecture for recursive, compartment-aware cloud defense. --- @@ -240,6 +271,9 @@ Kings Guard is: Kings Guard is not: +- an actuator — it proposes containment and never performs it (§9.2); +- a holder of any standing credential (§3.4 rule 1); +- a state plane for any other layer, its immune memory included (§3.4 rule 3); - an identity provider; - an authorization registry; - a secret store; @@ -257,13 +291,26 @@ The repository should evolve through clear layers: phenotype, observation, signal, effector, tolerance, inflammation, and immune memory. 2. **Assessment loop:** provide a minimal service that ingests observations, - evaluates posture against declared intent, and produces typed signals. -3. **Bounded response:** integrate with selected effectors for isolation, - throttling, revocation, or reconstitution under explicit policy. + evaluates posture against declared intent, and produces typed signals — + against **real emitted events**, not fixtures. §12's fourth step + ("kings-guard observes it in operation") is the estate's, and it is + unstaffed until this stage is live. Completeness of the stream is part of + the judgment, not an assumption about it (§9.6). +3. **Bounded proposal:** emit containment *requests* — isolation, throttling, + revocation, reconstitution — as typed, authority-bounded proposals to the + engine that renders them. kings-guard never actuates (§9.2); the actuation + surface is an Engine concept and is unowned estate-wide. This stage is + complete when the proposals are well-formed and reconstructable, not when + anything is contained. 4. **Recovery and validation:** prove that known-good restoration can be coordinated and verified, not merely requested. 5. **Federated memory:** retain reusable defensive knowledge without exposing - tenant-confidential operational detail. + tenant-confidential operational detail — and **without becoming a state + plane**. Under §3.4 rule 3 agent memory may not become state another layer + depends on at runtime. Immune memory may inform kings-guard's own judgment + and may be published as evidence; no engine, PEP, or workload may read it as + an input it depends on. If that ever becomes desirable it is a Tooling + catalog change under §4, not a quiet integration. --- diff --git a/SCOPE.md b/SCOPE.md index e0750f9..59fd958 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -23,9 +23,13 @@ platforms. ## Core Idea `kings-guard` turns declared healthy intent plus observed runtime behavior into -posture judgments, typed security signals, and bounded response requests. It -consumes evidence from identity, authorization, secret, and runtime systems -without replacing those systems' primary authority. +posture judgments, typed security signals, and bounded response **requests**. It +consumes evidence without replacing any system's primary authority, and it +actuates nothing: containment is rendered by an Engine and enforced by a PEP +(statute §9.2). + +The one-line test for anything proposed here: **does it judge and propose, or +does it decide and act?** The first is in scope. The second is another layer's. --- @@ -33,19 +37,37 @@ without replacing those systems' primary authority. - Canonical terminology and contracts for security genome, phenotype, observation, signal, effector, tolerance, inflammation, and immune memory. +- **Evidence classification** — marking each consumed stream load-bearing or + attributive (§9.6), since the obligations differ. +- **The emission-cadence declaration draft** (§17). kings-guard is its only + consumer and drafts it; Taxonomy owns it. Includes the reconciliation or + heartbeat form required for low-volume load-bearing classes, where rate + monitoring cannot work. +- **Stream-completeness judgment** — treating silence as a signal, and carrying + the resulting doubt in the posture output rather than reporting confidence in + a stream that may be incomplete. - Reference architecture and boundary documents for adaptive defense in multi-tenant and agent-active environments. - Minimal posture-evaluation loop design: ingest observations, compare against intended healthy state, and emit typed posture/signal results. -- Integration seams to adjacent security systems such as `key-cape`, - `flex-auth`, `secrets-engine`, `ops-warden`, and the Railiance runtime - layers. +- Integration seams to adjacent security systems, taken **through the owning + engine**: `access-engine` (the decision point, currently named `flex-auth`), + `secrets-engine`, `user-engine`, `audit-core`, and the Railiance runtime + layers. `key-cape` and OpenBao are Tooling and are never contacted directly. - Non-secret evidence, workplans, and repo-operational metadata. --- ## Out of Scope +- **Actuation of any kind.** Reduce authority, require step-up, isolate a + workload — these are authority-changing operations rendered by an Engine and + enforced by a PEP. kings-guard proposes them and never performs them, even + when no engine surface exists to receive the proposal. +- **Holding a standing credential** (§3.4 rule 1). +- **Becoming a state plane for another layer**, immune memory included + (§3.4 rule 3). Immune memory informs kings-guard's judgment and may be + published as evidence; nothing may depend on it at runtime. - Identity issuance, login, MFA, or token minting. - Any direct client for a Tooling-layer system (OpenBao, key-cape components, a database, a cluster) — every such need routes through the owning engine. @@ -53,6 +75,8 @@ without replacing those systems' primary authority. estate's only decision point. - "Control plane" as a self-description — that vocabulary belongs to the Engine layer. +- Claiming that an event's absence from an archive proves it did not happen, or + that a quiet stream is a healthy one (§9.6). - Authorization policy administration or final resource allow/deny decisions. - Secret custody, lease issuance, or raw secret-value delivery. - Infrastructure provisioning, workload deployment, or cluster/platform @@ -72,6 +96,13 @@ without replacing those systems' primary authority. - The implementation currently evaluates normalized observations and emits posture/signal results for one bounded pilot lane; it is not an enforcement service and will not become one. +- `layer.yaml`, `scripts/check_layer_conformance.py` and + `tests/test_layer_conformance.py` make the no-Tooling-client claim executable; + the companion cites them estate-wide as the reference for a repository with no + Tooling contacts at all. +- **Every input is still a fixture.** No real emitted event has reached the + evaluator, so statute §12's fourth step remains unstaffed. Closing that is + `KG-WP-0003`. --- diff --git a/history/2026-08-29-layer-model-v0.7-scope-intent-review.md b/history/2026-08-29-layer-model-v0.7-scope-intent-review.md new file mode 100644 index 0000000..44ddaa0 --- /dev/null +++ b/history/2026-08-29-layer-model-v0.7-scope-intent-review.md @@ -0,0 +1,184 @@ +--- +title: "Scope vs Intent review against Security Layer Model v0.7" +date: 2026-08-29 +repo: kings-guard +author: kings-guard +standard: net-kingdom/canon/standards/security-layer-model_v0.7.md +companion: net-kingdom/SECURITY-COMPANION.md +status: complete +outcome: KG-WP-0003 +classification: Public +--- + +# Scope vs Intent review against Security Layer Model v0.7 + +The NetKingdom Security Layer Model reached **v0.7, accepted**, with a working +companion at `net-kingdom/SECURITY-COMPANION.md`. `INTENT.md` and `SCOPE.md` +have been adapted to it. This review compares the adapted documents against the +implementation and names what has to change. + +The finding in one line: **the documents are now correct and the code has not +caught up.** Every gap below is a place where `INTENT.md` or `SCOPE.md` now +claims something `src/kings_guard/` does not do. + +## 1. What the statute settled for this repository + +Four of our review findings were adopted across v0.5–v0.7, and two of them +changed what this repository is: + +- **Containment left us entirely (§9.2).** Reduce authority, require step-up, + isolate a workload are authority-changing operations, rendered by an Engine + and enforced by a PEP. kings-guard proposes containment and never performs it. + We had been carrying our inability to contain as our own gap; it was never + ours. The actuation surface is unowned estate-wide and held at zero. +- **The agent principal is now bound by four rules (§3.4).** v0.6 announced them + and never wrote them; we found that and offered to assent sight-unseen, and + v0.7 wrote them. They bind this repository harder than any other in the + catalog. + +Two obligations arrived with them: + +- **kings-guard drafts the emission-cadence declaration (§17)** — as its only + consumer. Ownership stays with Taxonomy; the draft is ours. +- **Load-bearing evidence MUST declare an expected cadence (§9.6)**, and for + low-volume classes — revocations, denials, containment — rate monitoring + cannot work, so the required form is reconciliation or a heartbeat. + +Our catalog entry is now: *adaptive defence and judgment; observation of +Staff-reachable sources — identity and secret observation pending; proposes +containment, which it does not own.* + +## 2. Where the repository conforms + +Worth stating, because the conformance position is unusual and is the thing most +easily lost in a refactor: + +- **No Tooling contact of any shape.** Not a §5.1 diagnostic read, not a §5.2 + conduit, not a §5.3 declared gap. `dependencies = []` in `pyproject.toml` is + load-bearing for this and must stay empty. +- **Blocked-clean (§11)**, which the statute rules MUST NOT rank below + conforming. Three capabilities sit at zero rather than being taken locally. +- **The claim is executable**, not asserted: `layer.yaml`, + `scripts/check_layer_conformance.py`, `tests/test_layer_conformance.py`. The + companion cites these estate-wide as the reference for a repository with no + Tooling contacts at all. +- **The asymmetry holds in code.** Every `EffectorRequest` carries an explicit + `authority_boundary`; the values in use are `advisory_only` and + `metadata_only`. No path widens authority. + +## 3. Gaps — Intent and Scope against the implementation + +### G1. Evidence is not classified load-bearing or attributive — §9.6 + +`ImmuneObservation` carries `source_system` and no evidence class. The statute +attaches different obligations to each: a load-bearing source MUST declare a +cadence, must emit atomically, and its absence is a finding; an attributive +source SHOULD. Without the classification the evaluator cannot know which +obligation applies to a stream, and `SCOPE.md` now claims we classify. + +*Necessity:* an evidence class on the observation and on the genome's declared +sources, with the obligation difference expressed in the contract document. + +### G2. No emission-cadence declaration exists — §17, and it is ours to draft + +`SecurityGenome` has no cadence field. We cannot implement silence-as-signal +without a schema for declared cadence, and inventing a local shape is the exact +drift §17 exists to prevent. The statute has accepted us as drafter. + +*Necessity:* draft the declaration against `qonto-assistant` as the one real +source, covering both forms — expected rate for volume classes, and +reconciliation or heartbeat for low-volume load-bearing classes — and hand it to +Taxonomy. It belongs alongside the security genome: a source already declares +its intent there, and expected emission cadence is a claim of the same kind. + +### G3. Silence is not a signal — §9.6 + +`PostureEvaluator.evaluate()` takes one observation and returns one assessment. +It is stateless and has no view of a stream. An event that is never emitted is +never evaluated: no finding, no signal, no posture change, and the last posture +stands. Suppression therefore biases posture **optimistic**, silently. This is +the failure the statute names, reproduced one layer up in the consumer. + +*Necessity:* a stream-level evaluation path alongside the per-observation one — +cadence comparison for volume classes, reconciliation or heartbeat absence for +rare ones — emitting a finding when the stream itself goes quiet. + +### G4. Confidence measures the record, not the stream — §9.6 + +`confidence_score` starts at 70 and rises with `policy_version`, `latency_ms` +and `resource_scope`. It is a measure of field richness in the record we +received. A perfectly-formed observation drawn from a 90%-suppressed stream +scores 85. The score cannot express the doubt the statute now requires us to +carry. + +*Necessity:* separate completeness from richness. Posture output should carry a +stream-completeness dimension that degrades when cadence is unmet or a heartbeat +is missing, and `PostureAssessment` should be able to say *this judgment rests +on a stream I cannot vouch for.* + +### G5. Nothing prevents immune memory becoming a state plane — §3.4 rule 3 + +`ImmuneMemoryEntry` exists with `confidentiality: str = "non-secret"` and no +rule about who may depend on it. `INTENT.md` stage 5 (federated memory) is +exactly the shape that could drift into a state plane, and the statute forbids +it unless catalogued as Tooling. + +*Necessity:* state the constraint in `specs/ImmuneContracts.md` — immune memory +informs kings-guard's judgment and may be published as evidence; no engine, PEP +or workload may read it as a runtime input — and assert it in a test so the +drift is caught rather than argued. + +### G6. Proposals carry no reference to what they were rendered against — §9.2 + +`EffectorRequest` has `target_system`, `action`, `authority_boundary`, `reason`, +`requires_human_approval`. §9.2 rules that a containment action is a decision +record, not a side channel. Our proposals are the input to such a record and +carry no request identity, so a proposal cannot be reconstructed against the +observation that produced it once it leaves this repository. + +*Necessity:* carry the originating observation and signal identity on the +request, so the eventual decision record can name what it was rendered for. + +### G7. The agent-principal rules are documented and unverified — §3.4 + +All four are now claimed in `INTENT.md`. None is checked. Rule 1 (no standing +credential) is mechanically checkable in this repository the same way the +no-Tooling-client claim is; rule 3 follows from G5. + +*Necessity:* extend `scripts/check_layer_conformance.py` to cover what can be +checked, and record honestly which rules are assertion rather than test. + +### G8. §12's fourth step is unstaffed — the pilot is fixture-only + +Every input is a hand-built fixture. Ten tests pass and none has met a real +event. The statute records this as disclosed, and §19's verdict — the estate can +propose and decide but cannot watch or act — names us as the watching half. + +Nothing blocks it: `qonto-assistant` publishes its own genome and audit stream, +needs no engine in the path, and its genome has not drifted since it was +written. This is the one substantial lane no engine gap touches. + +*Necessity:* ingest real emitted events from `qonto-assistant`, confirm or +correct the observation mapping, keep the output advisory. + +### G9. Residual vocabulary — KG-IN-0002 + +`specs/NetKingdomImmuneArchitecture.md` predates the model and still uses +"control plane" across ~1900 lines. A scoping note heads the file; the body is +unadapted. Now also carries the stale stage-3 framing that §9.2 corrected. + +## 4. What is deliberately not being done + +- **No engine gap is being worked around.** Identity and secret observation stay + at zero. The blocked-clean position is the point, not an inconvenience. +- **No actuation.** G6 makes proposals reconstructable; it does not make them + actionable, and nothing here moves toward an effector that acts. +- **No Tooling client**, including for live ingest in G8 — `qonto-assistant` + is a governed domain assistant publishing its own stream, not a Tooling row. + +## 5. Disposition + +`KG-WP-0003` carries G1–G8. G9 remains `KG-IN-0002`. The ordering is forced: +G2 unblocks G3, and G3 unblocks G4; G1 is a prerequisite for all three because +the obligation differs by evidence class. G8 is independent and is what makes +the rest testable against something real. diff --git a/layer.yaml b/layer.yaml index 4452b9a..70b7746 100644 --- a/layer.yaml +++ b/layer.yaml @@ -1,6 +1,6 @@ # kings-guard — NetKingdom security layer declaration # -# Framework: net-kingdom/canon/standards/security-layer-model_v0.6.md +# Framework: net-kingdom/canon/standards/security-layer-model_v0.7.md # Assent: decisions/decisions.md KG-DEC-2026-001 (kings-guard's own voice, §11) # Validate: python3 scripts/check_layer_conformance.py # @@ -15,7 +15,7 @@ schema_version: "0.1" framework: netkingdom-security-layer-model -standard_version: "0.6" +standard_version: "0.7" repository: kings-guard layer: staff declared_by: decisions/decisions.md#KG-DEC-2026-001 @@ -24,6 +24,14 @@ declared_at: "2026-08-29" # §4 catalog entry, transcribed so drift between the catalog and this file is # visible. The standard is authoritative for the row; this records what we # understand ourselves to have been assigned. +# §3.4 — the four rules binding the agent principal. kings-guard offered to +# assent to these sight-unseen before they were written into v0.7. +agent_principal_rules: + no_standing_credential: true + tool_use_shapes: ["5.2-conduit", "engine-api"] + memory_is_not_a_state_plane: true + reconstructable_as_caller: true + catalog_entry: owns: - adaptive defence and judgment diff --git a/workplans/KG-WP-0003-evidence-completeness-and-live-observation.md b/workplans/KG-WP-0003-evidence-completeness-and-live-observation.md new file mode 100644 index 0000000..3bb86ed --- /dev/null +++ b/workplans/KG-WP-0003-evidence-completeness-and-live-observation.md @@ -0,0 +1,245 @@ +--- +id: KG-WP-0003 +type: workplan +title: "Evidence completeness and live observation" +domain: infotech +repo: kings-guard +status: ready +owner: kings-guard +topic_slug: netkingdom +created: "2026-08-29" +updated: "2026-08-29" +source_review: history/2026-08-29-layer-model-v0.7-scope-intent-review.md +standard: net-kingdom/canon/standards/security-layer-model_v0.7.md +--- + +# Evidence completeness and live observation + +Close the gap between what `INTENT.md` and `SCOPE.md` now claim under Security +Layer Model v0.7 and what `src/kings_guard/` actually does. Carries G1–G8 of +`history/2026-08-29-layer-model-v0.7-scope-intent-review.md`. + +Two things are being fixed. The repository consumes evidence and treats a quiet +stream as a healthy one, which the statute now forbids (§9.6). And statute §12's +fourth step — *kings-guard observes it in operation* — is unstaffed, because +every input is a fixture. + +## Boundaries this workplan does not cross + +- **No actuation.** kings-guard proposes containment and never performs it + (§9.2). T06 makes proposals reconstructable; it does not make them act. +- **No Tooling contact.** `dependencies = []` stays empty; `make check-layer` + must stay green on every task. `qonto-assistant` publishes its own stream and + is not a Tooling row, so T07 needs no engine in the path. +- **No engine gap worked around.** Identity and secret observation stay at zero. + +## Dependency order + +```text +T01 evidence classification + -> T02 emission-cadence declaration (draft, handed to Taxonomy) + -> T03 stream-completeness evaluation + -> T04 completeness in the posture output +T05 immune memory is not a state plane (independent) +T06 proposals carry their origin (independent) +T07 live observation (independent; makes the rest real) +T08 agent-principal conformance checks (after T05) +``` + +## Task: Classify consumed evidence load-bearing or attributive + +```task +id: KG-WP-0003-T01 +status: todo +priority: high +``` + +Statute §9.6 attaches different obligations to each class, and the repository +currently records neither. `ImmuneObservation` carries `source_system` and no +class; `SecurityGenome` declares no sources at all. + +Done when: + +- the evidence class is expressible on a declared source and on an observation; +- `specs/ImmuneContracts.md` states the obligation difference — a load-bearing + source MUST declare a cadence, an attributive source SHOULD — and states that + the class is the source's declaration, not kings-guard's inference; +- the `qonto-assistant` fixture declares a class for its audit stream, with the + reasoning recorded; +- tests cover both classes. + +## Task: Draft the emission-cadence declaration and hand it to Taxonomy + +```task +id: KG-WP-0003-T02 +status: todo +priority: high +``` + +Statute §17 requires the artifact and records kings-guard as its drafter, being +its only consumer. Ownership stays with Taxonomy. Inventing a local shape is the +drift §17 exists to prevent, so this is a draft for handover, not an internal +schema. + +Must cover both forms, because one does not substitute for the other: + +- an **expected rate** for volume classes; +- **reconciliation or a heartbeat** for low-volume load-bearing classes — + revocations, denials, containment actions — where rate monitoring cannot work + because a suppressed month is indistinguishable from a quiet one. The required + property is a positive claim that can itself go missing. + +Done when: + +- the draft lives in `specs/` and is written against `qonto-assistant` as the + one real source; +- it explains where the declaration belongs — alongside the security genome, on + the argument that expected cadence is a claim of intent like the rest of the + genome — and why; +- `GH-WP-0002-T04` is referenced as the reference instance for the heartbeat + form; +- it is sent to gate-house and to the Taxonomy repositories for ownership, and + the handover is recorded. + +## Task: Evaluate the stream, not only the observation + +```task +id: KG-WP-0003-T03 +status: todo +priority: high +``` + +`PostureEvaluator.evaluate()` is stateless and per-observation. An event that is +never emitted is never evaluated, so the last posture stands and suppression +biases posture optimistic. Silence must become a finding in its own right. + +Done when: + +- a stream-level evaluation path exists alongside the per-observation one; +- an unmet declared cadence produces a finding; +- a missing heartbeat, or a reconciliation divergence between the source's own + state transitions and the evidence count per class, produces a finding; +- the findings are distinguishable from content findings — the stream observed, + not its contents; +- no Tooling contact is introduced; the source publishes its own stream. + +## Task: Carry stream completeness in the posture output + +```task +id: KG-WP-0003-T04 +status: todo +priority: high +``` + +`confidence_score` starts at 70 and rises with field richness of the record +received. It measures the record, never the stream: a well-formed observation +from a 90%-suppressed stream scores 85. The judgment must be able to say *this +rests on a stream I cannot vouch for.* + +Done when: + +- completeness is separated from richness in `PostureAssessment`; +- an unmet cadence or missing heartbeat degrades the completeness dimension; +- the rationale text says so in words, not only in a number; +- a posture derived from an incomplete stream can never read as more trustworthy + than one derived from a complete one. + +## Task: State and test that immune memory is not a state plane + +```task +id: KG-WP-0003-T05 +status: todo +priority: medium +``` + +Statute §3.4 rule 3: agent memory, tool-call traces and prompt caches MUST NOT +become state another layer depends on at runtime unless catalogued as Tooling. +`ImmuneMemoryEntry` has no such rule, and `INTENT.md` stage 5 (federated memory) +is exactly the shape that could drift into one. + +Done when: + +- `specs/ImmuneContracts.md` states it: immune memory informs kings-guard's own + judgment and may be published as evidence; no engine, PEP or workload may read + it as a runtime input, and making it one is a §4 Tooling catalog change; +- a test asserts the constraint rather than leaving it to prose; +- the constraint is reflected in the `Direction of Evolution` stage-5 entry. + +## Task: Make containment proposals reconstructable to their origin + +```task +id: KG-WP-0003-T06 +status: todo +priority: medium +``` + +§9.2 rules that a containment action is a decision record, not a side channel. +`EffectorRequest` names a target and an action and carries no reference to what +produced it, so once a proposal leaves this repository it cannot be tied back to +the observation that caused it. + +Done when: + +- an effector request carries the originating observation and signal identity; +- the eventual decision record can name what the proposal was rendered for; +- `docs/AdjacentSystemBoundary.md` states the expectation on the receiving side; +- the authority boundary remains explicit and no value widens authority. + +## Task: Observe qonto-assistant in operation + +```task +id: KG-WP-0003-T07 +status: todo +priority: high +``` + +Statute §12's fourth step is aspiration until this is done, and §19's verdict +names kings-guard as the watching half of *can propose and decide but cannot +watch or act*. Every input today is a hand-built fixture; ten tests pass and +none has met a real event. + +Nothing blocks it. `qonto-assistant` publishes its own genome record and audit +stream, needs no engine in the path, and its genome has not drifted since it was +written. + +Done when: + +- real emitted audit events from `qonto-assistant` reach the evaluator; +- the observation mapping is confirmed against real events or corrected, and the + correction is reported back to `qonto-assistant`; +- output stays advisory — posture hints and metadata-only evidence, nothing that + actuates; +- the fixture is retained as a regression case rather than deleted; +- gate-house is told that step four is staffed, with what was found. + +## Task: Check the agent-principal rules that can be checked + +```task +id: KG-WP-0003-T08 +status: todo +priority: medium +``` + +All four §3.4 rules are now claimed in `INTENT.md` and none is verified. The +no-Tooling-client claim showed the pattern: a claim in prose becomes a claim in +a test, and the test carries the reason. + +Done when: + +- `scripts/check_layer_conformance.py` covers what is mechanically checkable — + at minimum rule 1, no standing credential held in the repository or its + configuration; +- rule 3 is covered by T05; +- rules that remain assertion rather than test are recorded as such in + `layer.yaml`, honestly, rather than implied to be checked; +- `make check-layer` stays green. + +## Success criteria + +1. Every task above is `done`. +2. `make test` and `make check-layer` both pass. +3. `pyproject.toml` still declares `dependencies = []`. +4. `INTENT.md` and `SCOPE.md` claim nothing the implementation does not do. +5. The emission-cadence draft has been handed to Taxonomy and the handover + recorded. +6. gate-house has been told that §12's fourth step is staffed.