coulomb/kings-guard
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Align with Security Layer Model v0.7; review scope vs intent; open KG-WP-0003

Browse source 
The standard is accepted at v0.7 with a working companion. v0.7 wrote the
§3.4 agent-principal rules that v0.6 announced and never wrote — our
finding — and credits kings-guard for it. Our other two findings landed
too: the actuation row is no longer attributed to us, and §17 records
kings-guard as drafter of the emission-cadence declaration.

INTENT.md now carries the declaration in frontmatter (layer: Staff,
conformance_state: blocked-clean) as the companion asks, plus prose in
our own voice. Adopted: the four agent-principal rules; the evidence
doctrine and our obligations under it; containment reframed as proposal
throughout. Direction of Evolution stage 3 rewritten — it described
integrating with effectors to actuate, which §9.2 forbids — and stage 5
now carries the constraint that federated memory may not become a state
plane.

SCOPE.md gains evidence classification, the cadence draft, and
stream-completeness judgment as in-scope; actuation, standing
credentials, and becoming a state plane as explicitly out.

history/2026-08-29-layer-model-v0.7-scope-intent-review.md assesses the
adapted documents against the implementation. The finding: the documents
are now correct and the code has not caught up. Nine gaps, G1-G8 carried
by KG-WP-0003, G9 remaining as KG-IN-0002.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UEtvmYUBP2fDtirJGWn5MW

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4014379@bnt-lap001
Assistant-Session: 4af9e20f-1768-4afc-951b-b507784e382b
This commit is contained in:
tegwick 2026-08-29 14:42:34 +02:00
parent 72c2a42d67
commit 97c7eea1da
5 changed files with 534 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

69
INTENT.md
View file

@ -1,16 +1,32 @@
---
# NetKingdom security layer declaration (statute §11, companion §2).
# Machine-readable form; the prose below is the same claim in our own voice.
# Full contact map and gap records: layer.yaml
layer: Staff
role: null # Engines only
standard: net-kingdom/canon/standards/security-layer-model_v0.7.md
standard_version: "0.7"
declared_by: decisions/decisions.md#KG-DEC-2026-001
declared_at: "2026-08-29"
conformance_state: blocked-clean
principal_kinds: [human, agent]
---
# INTENT
> **Layer: Staff.** *(NetKingdom Security Layer Model — current version
> `net-kingdom/canon/standards/security-layer-model_v0.6.md`, §4 catalog;
> **Layer: Staff.** *(NetKingdom Security Layer Model
> `net-kingdom/canon/standards/security-layer-model_v0.7.md`, **accepted**, §4
> catalog; working form: `net-kingdom/SECURITY-COMPANION.md`;
> ratified by `gate-house/decisions/decisions.md` GH-DEC-2026-001; assented here
> by `decisions/decisions.md` KG-DEC-2026-001 on 2026-08-28, against v0.1.)*
>
> **The machine-readable declaration required by §11 is `layer.yaml`**, checked
> by `scripts/check_layer_conformance.py` and tested in
> **The declaration is the frontmatter above plus `layer.yaml`**, checked by
> `scripts/check_layer_conformance.py` and tested in
> `tests/test_layer_conformance.py`. Prose cannot distinguish a declaration from
> a transcribed review, so the file is authoritative and this note is commentary.
> a transcribed review, so those are authoritative and this note is commentary
> in kings-guard's own voice, as the companion asks.
>
> **Catalog entry (v0.6 §4):** adaptive defence and judgment; observation of
> **Catalog entry (v0.7 §4):** adaptive defence and judgment; observation of
> Staff-reachable sources — identity and secret observation **pending**;
> **proposes** containment, which it does not own.
>
@ -32,6 +48,21 @@
> actuation surface is unowned and held at zero estate-wide, so no argument
> anywhere may assume containment is automatic.
>
> **The agent principal (§3.4).** kings-guard is Staff of the agentic kind, and
> v0.7 binds that principal with four rules this repository offered to accept
> before they were written. They are adopted here as repository invariants:
> **no standing credential** — authority is per task, time-bounded, attributable
> to the principal acted for; **tool use is a §5.2 conduit or an Engine API, and
> there is no third route** — a callable tool means the operation exists, not
> that this actor may invoke it; **agent memory is not a state plane** — immune
> memory, tool-call traces and prompt caches are kings-guard's own and MUST NOT
> become state another layer depends on at runtime unless catalogued as Tooling;
> **every action is reconstructable as the caller's**, bounded by §9.6.
>
> The third rule constrains this repository's own roadmap and is the one to
> watch: federated immune memory (*Direction of Evolution* stage 5) is exactly
> the shape that could drift into a state plane, and it may not.
>
> **Posture contract.** kings-guard **publishes** posture; `gate-house` defines
> its authority meaning; `access-engine` renders it. Posture is not a privilege
> source. The asymmetry is absolute: kings-guard may **reduce** authority,
@ -231,7 +262,7 @@ Kings Guard is:
- an adaptive defence concept and implementation home, in the Staff layer;
- a contract layer for healthy intent, observations, signals, posture, and
effectors;
- a coordination system for detection, containment, recovery, and memory;
- a coordination system for detection, containment **proposal**, recovery, and governed memory;
- a reference architecture for recursive, compartment-aware cloud defense.
---
@ -240,6 +271,9 @@ Kings Guard is:
Kings Guard is not:
- an actuator — it proposes containment and never performs it (§9.2);
- a holder of any standing credential (§3.4 rule 1);
- a state plane for any other layer, its immune memory included (§3.4 rule 3);
- an identity provider;
- an authorization registry;
- a secret store;
@ -257,13 +291,26 @@ The repository should evolve through clear layers:
phenotype, observation, signal, effector, tolerance, inflammation, and
immune memory.
2. **Assessment loop:** provide a minimal service that ingests observations,
evaluates posture against declared intent, and produces typed signals.
3. **Bounded response:** integrate with selected effectors for isolation,
throttling, revocation, or reconstitution under explicit policy.
evaluates posture against declared intent, and produces typed signals —
against **real emitted events**, not fixtures. §12's fourth step
("kings-guard observes it in operation") is the estate's, and it is
unstaffed until this stage is live. Completeness of the stream is part of
the judgment, not an assumption about it (§9.6).
3. **Bounded proposal:** emit containment *requests* — isolation, throttling,
revocation, reconstitution — as typed, authority-bounded proposals to the
engine that renders them. kings-guard never actuates (§9.2); the actuation
surface is an Engine concept and is unowned estate-wide. This stage is
complete when the proposals are well-formed and reconstructable, not when
anything is contained.
4. **Recovery and validation:** prove that known-good restoration can be
coordinated and verified, not merely requested.
5. **Federated memory:** retain reusable defensive knowledge without exposing
tenant-confidential operational detail.
tenant-confidential operational detail — and **without becoming a state
plane**. Under §3.4 rule 3 agent memory may not become state another layer
depends on at runtime. Immune memory may inform kings-guard's own judgment
and may be published as evidence; no engine, PEP, or workload may read it as
an input it depends on. If that ever becomes desirable it is a Tooling
catalog change under §4, not a quiet integration.
---