Align with Security Layer Model v0.7; review scope vs intent; open KG-WP-0003
The standard is accepted at v0.7 with a working companion. v0.7 wrote the §3.4 agent-principal rules that v0.6 announced and never wrote — our finding — and credits kings-guard for it. Our other two findings landed too: the actuation row is no longer attributed to us, and §17 records kings-guard as drafter of the emission-cadence declaration. INTENT.md now carries the declaration in frontmatter (layer: Staff, conformance_state: blocked-clean) as the companion asks, plus prose in our own voice. Adopted: the four agent-principal rules; the evidence doctrine and our obligations under it; containment reframed as proposal throughout. Direction of Evolution stage 3 rewritten — it described integrating with effectors to actuate, which §9.2 forbids — and stage 5 now carries the constraint that federated memory may not become a state plane. SCOPE.md gains evidence classification, the cadence draft, and stream-completeness judgment as in-scope; actuation, standing credentials, and becoming a state plane as explicitly out. history/2026-08-29-layer-model-v0.7-scope-intent-review.md assesses the adapted documents against the implementation. The finding: the documents are now correct and the code has not caught up. Nine gaps, G1-G8 carried by KG-WP-0003, G9 remaining as KG-IN-0002. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UEtvmYUBP2fDtirJGWn5MW Assistant: claude-code Assistant-Model: opus Assistant-Process: 4014379@bnt-lap001 Assistant-Session: 4af9e20f-1768-4afc-951b-b507784e382b
This commit is contained in:
parent
72c2a42d67
commit
97c7eea1da
5 changed files with 534 additions and 19 deletions
|
|
@ -0,0 +1,245 @@
|
|||
---
|
||||
id: KG-WP-0003
|
||||
type: workplan
|
||||
title: "Evidence completeness and live observation"
|
||||
domain: infotech
|
||||
repo: kings-guard
|
||||
status: ready
|
||||
owner: kings-guard
|
||||
topic_slug: netkingdom
|
||||
created: "2026-08-29"
|
||||
updated: "2026-08-29"
|
||||
source_review: history/2026-08-29-layer-model-v0.7-scope-intent-review.md
|
||||
standard: net-kingdom/canon/standards/security-layer-model_v0.7.md
|
||||
---
|
||||
|
||||
# Evidence completeness and live observation
|
||||
|
||||
Close the gap between what `INTENT.md` and `SCOPE.md` now claim under Security
|
||||
Layer Model v0.7 and what `src/kings_guard/` actually does. Carries G1–G8 of
|
||||
`history/2026-08-29-layer-model-v0.7-scope-intent-review.md`.
|
||||
|
||||
Two things are being fixed. The repository consumes evidence and treats a quiet
|
||||
stream as a healthy one, which the statute now forbids (§9.6). And statute §12's
|
||||
fourth step — *kings-guard observes it in operation* — is unstaffed, because
|
||||
every input is a fixture.
|
||||
|
||||
## Boundaries this workplan does not cross
|
||||
|
||||
- **No actuation.** kings-guard proposes containment and never performs it
|
||||
(§9.2). T06 makes proposals reconstructable; it does not make them act.
|
||||
- **No Tooling contact.** `dependencies = []` stays empty; `make check-layer`
|
||||
must stay green on every task. `qonto-assistant` publishes its own stream and
|
||||
is not a Tooling row, so T07 needs no engine in the path.
|
||||
- **No engine gap worked around.** Identity and secret observation stay at zero.
|
||||
|
||||
## Dependency order
|
||||
|
||||
```text
|
||||
T01 evidence classification
|
||||
-> T02 emission-cadence declaration (draft, handed to Taxonomy)
|
||||
-> T03 stream-completeness evaluation
|
||||
-> T04 completeness in the posture output
|
||||
T05 immune memory is not a state plane (independent)
|
||||
T06 proposals carry their origin (independent)
|
||||
T07 live observation (independent; makes the rest real)
|
||||
T08 agent-principal conformance checks (after T05)
|
||||
```
|
||||
|
||||
## Task: Classify consumed evidence load-bearing or attributive
|
||||
|
||||
```task
|
||||
id: KG-WP-0003-T01
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Statute §9.6 attaches different obligations to each class, and the repository
|
||||
currently records neither. `ImmuneObservation` carries `source_system` and no
|
||||
class; `SecurityGenome` declares no sources at all.
|
||||
|
||||
Done when:
|
||||
|
||||
- the evidence class is expressible on a declared source and on an observation;
|
||||
- `specs/ImmuneContracts.md` states the obligation difference — a load-bearing
|
||||
source MUST declare a cadence, an attributive source SHOULD — and states that
|
||||
the class is the source's declaration, not kings-guard's inference;
|
||||
- the `qonto-assistant` fixture declares a class for its audit stream, with the
|
||||
reasoning recorded;
|
||||
- tests cover both classes.
|
||||
|
||||
## Task: Draft the emission-cadence declaration and hand it to Taxonomy
|
||||
|
||||
```task
|
||||
id: KG-WP-0003-T02
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Statute §17 requires the artifact and records kings-guard as its drafter, being
|
||||
its only consumer. Ownership stays with Taxonomy. Inventing a local shape is the
|
||||
drift §17 exists to prevent, so this is a draft for handover, not an internal
|
||||
schema.
|
||||
|
||||
Must cover both forms, because one does not substitute for the other:
|
||||
|
||||
- an **expected rate** for volume classes;
|
||||
- **reconciliation or a heartbeat** for low-volume load-bearing classes —
|
||||
revocations, denials, containment actions — where rate monitoring cannot work
|
||||
because a suppressed month is indistinguishable from a quiet one. The required
|
||||
property is a positive claim that can itself go missing.
|
||||
|
||||
Done when:
|
||||
|
||||
- the draft lives in `specs/` and is written against `qonto-assistant` as the
|
||||
one real source;
|
||||
- it explains where the declaration belongs — alongside the security genome, on
|
||||
the argument that expected cadence is a claim of intent like the rest of the
|
||||
genome — and why;
|
||||
- `GH-WP-0002-T04` is referenced as the reference instance for the heartbeat
|
||||
form;
|
||||
- it is sent to gate-house and to the Taxonomy repositories for ownership, and
|
||||
the handover is recorded.
|
||||
|
||||
## Task: Evaluate the stream, not only the observation
|
||||
|
||||
```task
|
||||
id: KG-WP-0003-T03
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
`PostureEvaluator.evaluate()` is stateless and per-observation. An event that is
|
||||
never emitted is never evaluated, so the last posture stands and suppression
|
||||
biases posture optimistic. Silence must become a finding in its own right.
|
||||
|
||||
Done when:
|
||||
|
||||
- a stream-level evaluation path exists alongside the per-observation one;
|
||||
- an unmet declared cadence produces a finding;
|
||||
- a missing heartbeat, or a reconciliation divergence between the source's own
|
||||
state transitions and the evidence count per class, produces a finding;
|
||||
- the findings are distinguishable from content findings — the stream observed,
|
||||
not its contents;
|
||||
- no Tooling contact is introduced; the source publishes its own stream.
|
||||
|
||||
## Task: Carry stream completeness in the posture output
|
||||
|
||||
```task
|
||||
id: KG-WP-0003-T04
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
`confidence_score` starts at 70 and rises with field richness of the record
|
||||
received. It measures the record, never the stream: a well-formed observation
|
||||
from a 90%-suppressed stream scores 85. The judgment must be able to say *this
|
||||
rests on a stream I cannot vouch for.*
|
||||
|
||||
Done when:
|
||||
|
||||
- completeness is separated from richness in `PostureAssessment`;
|
||||
- an unmet cadence or missing heartbeat degrades the completeness dimension;
|
||||
- the rationale text says so in words, not only in a number;
|
||||
- a posture derived from an incomplete stream can never read as more trustworthy
|
||||
than one derived from a complete one.
|
||||
|
||||
## Task: State and test that immune memory is not a state plane
|
||||
|
||||
```task
|
||||
id: KG-WP-0003-T05
|
||||
status: todo
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Statute §3.4 rule 3: agent memory, tool-call traces and prompt caches MUST NOT
|
||||
become state another layer depends on at runtime unless catalogued as Tooling.
|
||||
`ImmuneMemoryEntry` has no such rule, and `INTENT.md` stage 5 (federated memory)
|
||||
is exactly the shape that could drift into one.
|
||||
|
||||
Done when:
|
||||
|
||||
- `specs/ImmuneContracts.md` states it: immune memory informs kings-guard's own
|
||||
judgment and may be published as evidence; no engine, PEP or workload may read
|
||||
it as a runtime input, and making it one is a §4 Tooling catalog change;
|
||||
- a test asserts the constraint rather than leaving it to prose;
|
||||
- the constraint is reflected in the `Direction of Evolution` stage-5 entry.
|
||||
|
||||
## Task: Make containment proposals reconstructable to their origin
|
||||
|
||||
```task
|
||||
id: KG-WP-0003-T06
|
||||
status: todo
|
||||
priority: medium
|
||||
```
|
||||
|
||||
§9.2 rules that a containment action is a decision record, not a side channel.
|
||||
`EffectorRequest` names a target and an action and carries no reference to what
|
||||
produced it, so once a proposal leaves this repository it cannot be tied back to
|
||||
the observation that caused it.
|
||||
|
||||
Done when:
|
||||
|
||||
- an effector request carries the originating observation and signal identity;
|
||||
- the eventual decision record can name what the proposal was rendered for;
|
||||
- `docs/AdjacentSystemBoundary.md` states the expectation on the receiving side;
|
||||
- the authority boundary remains explicit and no value widens authority.
|
||||
|
||||
## Task: Observe qonto-assistant in operation
|
||||
|
||||
```task
|
||||
id: KG-WP-0003-T07
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Statute §12's fourth step is aspiration until this is done, and §19's verdict
|
||||
names kings-guard as the watching half of *can propose and decide but cannot
|
||||
watch or act*. Every input today is a hand-built fixture; ten tests pass and
|
||||
none has met a real event.
|
||||
|
||||
Nothing blocks it. `qonto-assistant` publishes its own genome record and audit
|
||||
stream, needs no engine in the path, and its genome has not drifted since it was
|
||||
written.
|
||||
|
||||
Done when:
|
||||
|
||||
- real emitted audit events from `qonto-assistant` reach the evaluator;
|
||||
- the observation mapping is confirmed against real events or corrected, and the
|
||||
correction is reported back to `qonto-assistant`;
|
||||
- output stays advisory — posture hints and metadata-only evidence, nothing that
|
||||
actuates;
|
||||
- the fixture is retained as a regression case rather than deleted;
|
||||
- gate-house is told that step four is staffed, with what was found.
|
||||
|
||||
## Task: Check the agent-principal rules that can be checked
|
||||
|
||||
```task
|
||||
id: KG-WP-0003-T08
|
||||
status: todo
|
||||
priority: medium
|
||||
```
|
||||
|
||||
All four §3.4 rules are now claimed in `INTENT.md` and none is verified. The
|
||||
no-Tooling-client claim showed the pattern: a claim in prose becomes a claim in
|
||||
a test, and the test carries the reason.
|
||||
|
||||
Done when:
|
||||
|
||||
- `scripts/check_layer_conformance.py` covers what is mechanically checkable —
|
||||
at minimum rule 1, no standing credential held in the repository or its
|
||||
configuration;
|
||||
- rule 3 is covered by T05;
|
||||
- rules that remain assertion rather than test are recorded as such in
|
||||
`layer.yaml`, honestly, rather than implied to be checked;
|
||||
- `make check-layer` stays green.
|
||||
|
||||
## Success criteria
|
||||
|
||||
1. Every task above is `done`.
|
||||
2. `make test` and `make check-layer` both pass.
|
||||
3. `pyproject.toml` still declares `dependencies = []`.
|
||||
4. `INTENT.md` and `SCOPE.md` claim nothing the implementation does not do.
|
||||
5. The emission-cadence draft has been handed to Taxonomy and the handover
|
||||
recorded.
|
||||
6. gate-house has been told that §12's fourth step is staffed.
|
||||
Loading…
Add table
Add a link
Reference in a new issue