Align with Security Layer Model v0.7; review scope vs intent; open KG-WP-0003

The standard is accepted at v0.7 with a working companion. v0.7 wrote the
§3.4 agent-principal rules that v0.6 announced and never wrote — our
finding — and credits kings-guard for it. Our other two findings landed
too: the actuation row is no longer attributed to us, and §17 records
kings-guard as drafter of the emission-cadence declaration.

INTENT.md now carries the declaration in frontmatter (layer: Staff,
conformance_state: blocked-clean) as the companion asks, plus prose in
our own voice. Adopted: the four agent-principal rules; the evidence
doctrine and our obligations under it; containment reframed as proposal
throughout. Direction of Evolution stage 3 rewritten — it described
integrating with effectors to actuate, which §9.2 forbids — and stage 5
now carries the constraint that federated memory may not become a state
plane.

SCOPE.md gains evidence classification, the cadence draft, and
stream-completeness judgment as in-scope; actuation, standing
credentials, and becoming a state plane as explicitly out.

history/2026-08-29-layer-model-v0.7-scope-intent-review.md assesses the
adapted documents against the implementation. The finding: the documents
are now correct and the code has not caught up. Nine gaps, G1-G8 carried
by KG-WP-0003, G9 remaining as KG-IN-0002.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UEtvmYUBP2fDtirJGWn5MW

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4014379@bnt-lap001
Assistant-Session: 4af9e20f-1768-4afc-951b-b507784e382b

INTENT.md

@@ -1,16 +1,32 @@
+---
+# NetKingdom security layer declaration (statute §11, companion §2).
+# Machine-readable form; the prose below is the same claim in our own voice.
+# Full contact map and gap records: layer.yaml
+layer: Staff
+role: null                     # Engines only
+standard: net-kingdom/canon/standards/security-layer-model_v0.7.md
+standard_version: "0.7"
+declared_by: decisions/decisions.md#KG-DEC-2026-001
+declared_at: "2026-08-29"
+conformance_state: blocked-clean
+principal_kinds: [human, agent]
+---
+
 # INTENT
 
-> **Layer: Staff.** *(NetKingdom Security Layer Model — current version
+> **Layer: Staff.** *(NetKingdom Security Layer Model
-> `net-kingdom/canon/standards/security-layer-model_v0.6.md`, §4 catalog;
+> `net-kingdom/canon/standards/security-layer-model_v0.7.md`, **accepted**, §4
+> catalog; working form: `net-kingdom/SECURITY-COMPANION.md`;
 > ratified by `gate-house/decisions/decisions.md` GH-DEC-2026-001; assented here
 > by `decisions/decisions.md` KG-DEC-2026-001 on 2026-08-28, against v0.1.)*
 >
-> **The machine-readable declaration required by §11 is `layer.yaml`**, checked
+> **The declaration is the frontmatter above plus `layer.yaml`**, checked by
-> by `scripts/check_layer_conformance.py` and tested in
+> `scripts/check_layer_conformance.py` and tested in
 > `tests/test_layer_conformance.py`. Prose cannot distinguish a declaration from
-> a transcribed review, so the file is authoritative and this note is commentary.
+> a transcribed review, so those are authoritative and this note is commentary
+> in kings-guard's own voice, as the companion asks.
 >
-> **Catalog entry (v0.6 §4):** adaptive defence and judgment; observation of
+> **Catalog entry (v0.7 §4):** adaptive defence and judgment; observation of
 > Staff-reachable sources — identity and secret observation **pending**;
 > **proposes** containment, which it does not own.
 >
@@ -32,6 +48,21 @@
 > actuation surface is unowned and held at zero estate-wide, so no argument
 > anywhere may assume containment is automatic.
 >
+> **The agent principal (§3.4).** kings-guard is Staff of the agentic kind, and
+> v0.7 binds that principal with four rules this repository offered to accept
+> before they were written. They are adopted here as repository invariants:
+> **no standing credential** — authority is per task, time-bounded, attributable
+> to the principal acted for; **tool use is a §5.2 conduit or an Engine API, and
+> there is no third route** — a callable tool means the operation exists, not
+> that this actor may invoke it; **agent memory is not a state plane** — immune
+> memory, tool-call traces and prompt caches are kings-guard's own and MUST NOT
+> become state another layer depends on at runtime unless catalogued as Tooling;
+> **every action is reconstructable as the caller's**, bounded by §9.6.
+>
+> The third rule constrains this repository's own roadmap and is the one to
+> watch: federated immune memory (*Direction of Evolution* stage 5) is exactly
+> the shape that could drift into a state plane, and it may not.
+>
 > **Posture contract.** kings-guard **publishes** posture; `gate-house` defines
 > its authority meaning; `access-engine` renders it. Posture is not a privilege
 > source. The asymmetry is absolute: kings-guard may **reduce** authority,
@@ -231,7 +262,7 @@ Kings Guard is:
 - an adaptive defence concept and implementation home, in the Staff layer;
 - a contract layer for healthy intent, observations, signals, posture, and
   effectors;
-- a coordination system for detection, containment, recovery, and memory;
+- a coordination system for detection, containment **proposal**, recovery, and governed memory;
 - a reference architecture for recursive, compartment-aware cloud defense.
 
 ---
@@ -240,6 +271,9 @@ Kings Guard is:
 
 Kings Guard is not:
 
+- an actuator — it proposes containment and never performs it (§9.2);
+- a holder of any standing credential (§3.4 rule 1);
+- a state plane for any other layer, its immune memory included (§3.4 rule 3);
 - an identity provider;
 - an authorization registry;
 - a secret store;
@@ -257,13 +291,26 @@ The repository should evolve through clear layers:
    phenotype, observation, signal, effector, tolerance, inflammation, and
    immune memory.
 2. **Assessment loop:** provide a minimal service that ingests observations,
-   evaluates posture against declared intent, and produces typed signals.
+   evaluates posture against declared intent, and produces typed signals —
-3. **Bounded response:** integrate with selected effectors for isolation,
+   against **real emitted events**, not fixtures. §12's fourth step
-   throttling, revocation, or reconstitution under explicit policy.
+   ("kings-guard observes it in operation") is the estate's, and it is
+   unstaffed until this stage is live. Completeness of the stream is part of
+   the judgment, not an assumption about it (§9.6).
+3. **Bounded proposal:** emit containment *requests* — isolation, throttling,
+   revocation, reconstitution — as typed, authority-bounded proposals to the
+   engine that renders them. kings-guard never actuates (§9.2); the actuation
+   surface is an Engine concept and is unowned estate-wide. This stage is
+   complete when the proposals are well-formed and reconstructable, not when
+   anything is contained.
 4. **Recovery and validation:** prove that known-good restoration can be
    coordinated and verified, not merely requested.
 5. **Federated memory:** retain reusable defensive knowledge without exposing
-   tenant-confidential operational detail.
+   tenant-confidential operational detail — and **without becoming a state
+   plane**. Under §3.4 rule 3 agent memory may not become state another layer
+   depends on at runtime. Immune memory may inform kings-guard's own judgment
+   and may be published as evidence; no engine, PEP, or workload may read it as
+   an input it depends on. If that ever becomes desirable it is a Tooling
+   catalog change under §4, not a quiet integration.
 
 ---
 

SCOPE.md

@@ -23,9 +23,13 @@ platforms.
 ## Core Idea
 
 `kings-guard` turns declared healthy intent plus observed runtime behavior into
-posture judgments, typed security signals, and bounded response requests. It
+posture judgments, typed security signals, and bounded response **requests**. It
-consumes evidence from identity, authorization, secret, and runtime systems
+consumes evidence without replacing any system's primary authority, and it
-without replacing those systems' primary authority.
+actuates nothing: containment is rendered by an Engine and enforced by a PEP
+(statute §9.2).
+
+The one-line test for anything proposed here: **does it judge and propose, or
+does it decide and act?** The first is in scope. The second is another layer's.
 
 ---
 
@@ -33,19 +37,37 @@ without replacing those systems' primary authority.
 
 - Canonical terminology and contracts for security genome, phenotype,
   observation, signal, effector, tolerance, inflammation, and immune memory.
+- **Evidence classification** — marking each consumed stream load-bearing or
+  attributive (§9.6), since the obligations differ.
+- **The emission-cadence declaration draft** (§17). kings-guard is its only
+  consumer and drafts it; Taxonomy owns it. Includes the reconciliation or
+  heartbeat form required for low-volume load-bearing classes, where rate
+  monitoring cannot work.
+- **Stream-completeness judgment** — treating silence as a signal, and carrying
+  the resulting doubt in the posture output rather than reporting confidence in
+  a stream that may be incomplete.
 - Reference architecture and boundary documents for adaptive defense in
   multi-tenant and agent-active environments.
 - Minimal posture-evaluation loop design: ingest observations, compare against
   intended healthy state, and emit typed posture/signal results.
-- Integration seams to adjacent security systems such as `key-cape`,
+- Integration seams to adjacent security systems, taken **through the owning
-  `flex-auth`, `secrets-engine`, `ops-warden`, and the Railiance runtime
+  engine**: `access-engine` (the decision point, currently named `flex-auth`),
-  layers.
+  `secrets-engine`, `user-engine`, `audit-core`, and the Railiance runtime
+  layers. `key-cape` and OpenBao are Tooling and are never contacted directly.
 - Non-secret evidence, workplans, and repo-operational metadata.
 
 ---
 
 ## Out of Scope
 
+- **Actuation of any kind.** Reduce authority, require step-up, isolate a
+  workload — these are authority-changing operations rendered by an Engine and
+  enforced by a PEP. kings-guard proposes them and never performs them, even
+  when no engine surface exists to receive the proposal.
+- **Holding a standing credential** (§3.4 rule 1).
+- **Becoming a state plane for another layer**, immune memory included
+  (§3.4 rule 3). Immune memory informs kings-guard's judgment and may be
+  published as evidence; nothing may depend on it at runtime.
 - Identity issuance, login, MFA, or token minting.
 - Any direct client for a Tooling-layer system (OpenBao, key-cape components,
   a database, a cluster) — every such need routes through the owning engine.
@@ -53,6 +75,8 @@ without replacing those systems' primary authority.
   estate's only decision point.
 - "Control plane" as a self-description — that vocabulary belongs to the
   Engine layer.
+- Claiming that an event's absence from an archive proves it did not happen, or
+  that a quiet stream is a healthy one (§9.6).
 - Authorization policy administration or final resource allow/deny decisions.
 - Secret custody, lease issuance, or raw secret-value delivery.
 - Infrastructure provisioning, workload deployment, or cluster/platform
@@ -72,6 +96,13 @@ without replacing those systems' primary authority.
 - The implementation currently evaluates normalized observations and emits
   posture/signal results for one bounded pilot lane; it is not an enforcement
   service and will not become one.
+- `layer.yaml`, `scripts/check_layer_conformance.py` and
+  `tests/test_layer_conformance.py` make the no-Tooling-client claim executable;
+  the companion cites them estate-wide as the reference for a repository with no
+  Tooling contacts at all.
+- **Every input is still a fixture.** No real emitted event has reached the
+  evaluator, so statute §12's fourth step remains unstaffed. Closing that is
+  `KG-WP-0003`.
 
 ---
 

history/2026-08-29-layer-model-v0.7-scope-intent-review.md

@@ -0,0 +1,184 @@
+---
+title: "Scope vs Intent review against Security Layer Model v0.7"
+date: 2026-08-29
+repo: kings-guard
+author: kings-guard
+standard: net-kingdom/canon/standards/security-layer-model_v0.7.md
+companion: net-kingdom/SECURITY-COMPANION.md
+status: complete
+outcome: KG-WP-0003
+classification: Public
+---
+
+# Scope vs Intent review against Security Layer Model v0.7
+
+The NetKingdom Security Layer Model reached **v0.7, accepted**, with a working
+companion at `net-kingdom/SECURITY-COMPANION.md`. `INTENT.md` and `SCOPE.md`
+have been adapted to it. This review compares the adapted documents against the
+implementation and names what has to change.
+
+The finding in one line: **the documents are now correct and the code has not
+caught up.** Every gap below is a place where `INTENT.md` or `SCOPE.md` now
+claims something `src/kings_guard/` does not do.
+
+## 1. What the statute settled for this repository
+
+Four of our review findings were adopted across v0.5–v0.7, and two of them
+changed what this repository is:
+
+- **Containment left us entirely (§9.2).** Reduce authority, require step-up,
+  isolate a workload are authority-changing operations, rendered by an Engine
+  and enforced by a PEP. kings-guard proposes containment and never performs it.
+  We had been carrying our inability to contain as our own gap; it was never
+  ours. The actuation surface is unowned estate-wide and held at zero.
+- **The agent principal is now bound by four rules (§3.4).** v0.6 announced them
+  and never wrote them; we found that and offered to assent sight-unseen, and
+  v0.7 wrote them. They bind this repository harder than any other in the
+  catalog.
+
+Two obligations arrived with them:
+
+- **kings-guard drafts the emission-cadence declaration (§17)** — as its only
+  consumer. Ownership stays with Taxonomy; the draft is ours.
+- **Load-bearing evidence MUST declare an expected cadence (§9.6)**, and for
+  low-volume classes — revocations, denials, containment — rate monitoring
+  cannot work, so the required form is reconciliation or a heartbeat.
+
+Our catalog entry is now: *adaptive defence and judgment; observation of
+Staff-reachable sources — identity and secret observation pending; proposes
+containment, which it does not own.*
+
+## 2. Where the repository conforms
+
+Worth stating, because the conformance position is unusual and is the thing most
+easily lost in a refactor:
+
+- **No Tooling contact of any shape.** Not a §5.1 diagnostic read, not a §5.2
+  conduit, not a §5.3 declared gap. `dependencies = []` in `pyproject.toml` is
+  load-bearing for this and must stay empty.
+- **Blocked-clean (§11)**, which the statute rules MUST NOT rank below
+  conforming. Three capabilities sit at zero rather than being taken locally.
+- **The claim is executable**, not asserted: `layer.yaml`,
+  `scripts/check_layer_conformance.py`, `tests/test_layer_conformance.py`. The
+  companion cites these estate-wide as the reference for a repository with no
+  Tooling contacts at all.
+- **The asymmetry holds in code.** Every `EffectorRequest` carries an explicit
+  `authority_boundary`; the values in use are `advisory_only` and
+  `metadata_only`. No path widens authority.
+
+## 3. Gaps — Intent and Scope against the implementation
+
+### G1. Evidence is not classified load-bearing or attributive — §9.6
+
+`ImmuneObservation` carries `source_system` and no evidence class. The statute
+attaches different obligations to each: a load-bearing source MUST declare a
+cadence, must emit atomically, and its absence is a finding; an attributive
+source SHOULD. Without the classification the evaluator cannot know which
+obligation applies to a stream, and `SCOPE.md` now claims we classify.
+
+*Necessity:* an evidence class on the observation and on the genome's declared
+sources, with the obligation difference expressed in the contract document.
+
+### G2. No emission-cadence declaration exists — §17, and it is ours to draft
+
+`SecurityGenome` has no cadence field. We cannot implement silence-as-signal
+without a schema for declared cadence, and inventing a local shape is the exact
+drift §17 exists to prevent. The statute has accepted us as drafter.
+
+*Necessity:* draft the declaration against `qonto-assistant` as the one real
+source, covering both forms — expected rate for volume classes, and
+reconciliation or heartbeat for low-volume load-bearing classes — and hand it to
+Taxonomy. It belongs alongside the security genome: a source already declares
+its intent there, and expected emission cadence is a claim of the same kind.
+
+### G3. Silence is not a signal — §9.6
+
+`PostureEvaluator.evaluate()` takes one observation and returns one assessment.
+It is stateless and has no view of a stream. An event that is never emitted is
+never evaluated: no finding, no signal, no posture change, and the last posture
+stands. Suppression therefore biases posture **optimistic**, silently. This is
+the failure the statute names, reproduced one layer up in the consumer.
+
+*Necessity:* a stream-level evaluation path alongside the per-observation one —
+cadence comparison for volume classes, reconciliation or heartbeat absence for
+rare ones — emitting a finding when the stream itself goes quiet.
+
+### G4. Confidence measures the record, not the stream — §9.6
+
+`confidence_score` starts at 70 and rises with `policy_version`, `latency_ms`
+and `resource_scope`. It is a measure of field richness in the record we
+received. A perfectly-formed observation drawn from a 90%-suppressed stream
+scores 85. The score cannot express the doubt the statute now requires us to
+carry.
+
+*Necessity:* separate completeness from richness. Posture output should carry a
+stream-completeness dimension that degrades when cadence is unmet or a heartbeat
+is missing, and `PostureAssessment` should be able to say *this judgment rests
+on a stream I cannot vouch for.*
+
+### G5. Nothing prevents immune memory becoming a state plane — §3.4 rule 3
+
+`ImmuneMemoryEntry` exists with `confidentiality: str = "non-secret"` and no
+rule about who may depend on it. `INTENT.md` stage 5 (federated memory) is
+exactly the shape that could drift into a state plane, and the statute forbids
+it unless catalogued as Tooling.
+
+*Necessity:* state the constraint in `specs/ImmuneContracts.md` — immune memory
+informs kings-guard's judgment and may be published as evidence; no engine, PEP
+or workload may read it as a runtime input — and assert it in a test so the
+drift is caught rather than argued.
+
+### G6. Proposals carry no reference to what they were rendered against — §9.2
+
+`EffectorRequest` has `target_system`, `action`, `authority_boundary`, `reason`,
+`requires_human_approval`. §9.2 rules that a containment action is a decision
+record, not a side channel. Our proposals are the input to such a record and
+carry no request identity, so a proposal cannot be reconstructed against the
+observation that produced it once it leaves this repository.
+
+*Necessity:* carry the originating observation and signal identity on the
+request, so the eventual decision record can name what it was rendered for.
+
+### G7. The agent-principal rules are documented and unverified — §3.4
+
+All four are now claimed in `INTENT.md`. None is checked. Rule 1 (no standing
+credential) is mechanically checkable in this repository the same way the
+no-Tooling-client claim is; rule 3 follows from G5.
+
+*Necessity:* extend `scripts/check_layer_conformance.py` to cover what can be
+checked, and record honestly which rules are assertion rather than test.
+
+### G8. §12's fourth step is unstaffed — the pilot is fixture-only
+
+Every input is a hand-built fixture. Ten tests pass and none has met a real
+event. The statute records this as disclosed, and §19's verdict — the estate can
+propose and decide but cannot watch or act — names us as the watching half.
+
+Nothing blocks it: `qonto-assistant` publishes its own genome and audit stream,
+needs no engine in the path, and its genome has not drifted since it was
+written. This is the one substantial lane no engine gap touches.
+
+*Necessity:* ingest real emitted events from `qonto-assistant`, confirm or
+correct the observation mapping, keep the output advisory.
+
+### G9. Residual vocabulary — KG-IN-0002
+
+`specs/NetKingdomImmuneArchitecture.md` predates the model and still uses
+"control plane" across ~1900 lines. A scoping note heads the file; the body is
+unadapted. Now also carries the stale stage-3 framing that §9.2 corrected.
+
+## 4. What is deliberately not being done
+
+- **No engine gap is being worked around.** Identity and secret observation stay
+  at zero. The blocked-clean position is the point, not an inconvenience.
+- **No actuation.** G6 makes proposals reconstructable; it does not make them
+  actionable, and nothing here moves toward an effector that acts.
+- **No Tooling client**, including for live ingest in G8 — `qonto-assistant`
+  is a governed domain assistant publishing its own stream, not a Tooling row.
+
+## 5. Disposition
+
+`KG-WP-0003` carries G1–G8. G9 remains `KG-IN-0002`. The ordering is forced:
+G2 unblocks G3, and G3 unblocks G4; G1 is a prerequisite for all three because
+the obligation differs by evidence class. G8 is independent and is what makes
+the rest testable against something real.

layer.yaml

@@ -1,6 +1,6 @@
 # kings-guard — NetKingdom security layer declaration
 #
-# Framework: net-kingdom/canon/standards/security-layer-model_v0.6.md
+# Framework: net-kingdom/canon/standards/security-layer-model_v0.7.md
 # Assent:    decisions/decisions.md KG-DEC-2026-001 (kings-guard's own voice, §11)
 # Validate:  python3 scripts/check_layer_conformance.py
 #
@@ -15,7 +15,7 @@
 
 schema_version: "0.1"
 framework: netkingdom-security-layer-model
-standard_version: "0.6"
+standard_version: "0.7"
 repository: kings-guard
 layer: staff
 declared_by: decisions/decisions.md#KG-DEC-2026-001
@@ -24,6 +24,14 @@ declared_at: "2026-08-29"
 # §4 catalog entry, transcribed so drift between the catalog and this file is
 # visible. The standard is authoritative for the row; this records what we
 # understand ourselves to have been assigned.
+# §3.4 — the four rules binding the agent principal. kings-guard offered to
+# assent to these sight-unseen before they were written into v0.7.
+agent_principal_rules:
+  no_standing_credential: true
+  tool_use_shapes: ["5.2-conduit", "engine-api"]
+  memory_is_not_a_state_plane: true
+  reconstructable_as_caller: true
+
 catalog_entry:
   owns:
     - adaptive defence and judgment

workplans/KG-WP-0003-evidence-completeness-and-live-observation.md

@@ -0,0 +1,245 @@
+---
+id: KG-WP-0003
+type: workplan
+title: "Evidence completeness and live observation"
+domain: infotech
+repo: kings-guard
+status: ready
+owner: kings-guard
+topic_slug: netkingdom
+created: "2026-08-29"
+updated: "2026-08-29"
+source_review: history/2026-08-29-layer-model-v0.7-scope-intent-review.md
+standard: net-kingdom/canon/standards/security-layer-model_v0.7.md
+---
+
+# Evidence completeness and live observation
+
+Close the gap between what `INTENT.md` and `SCOPE.md` now claim under Security
+Layer Model v0.7 and what `src/kings_guard/` actually does. Carries G1–G8 of
+`history/2026-08-29-layer-model-v0.7-scope-intent-review.md`.
+
+Two things are being fixed. The repository consumes evidence and treats a quiet
+stream as a healthy one, which the statute now forbids (§9.6). And statute §12's
+fourth step — *kings-guard observes it in operation* — is unstaffed, because
+every input is a fixture.
+
+## Boundaries this workplan does not cross
+
+- **No actuation.** kings-guard proposes containment and never performs it
+  (§9.2). T06 makes proposals reconstructable; it does not make them act.
+- **No Tooling contact.** `dependencies = []` stays empty; `make check-layer`
+  must stay green on every task. `qonto-assistant` publishes its own stream and
+  is not a Tooling row, so T07 needs no engine in the path.
+- **No engine gap worked around.** Identity and secret observation stay at zero.
+
+## Dependency order
+
+```text
+T01 evidence classification
+  -> T02 emission-cadence declaration (draft, handed to Taxonomy)
+    -> T03 stream-completeness evaluation
+      -> T04 completeness in the posture output
+T05 immune memory is not a state plane   (independent)
+T06 proposals carry their origin          (independent)
+T07 live observation                      (independent; makes the rest real)
+T08 agent-principal conformance checks    (after T05)
+```
+
+## Task: Classify consumed evidence load-bearing or attributive
+
+```task
+id: KG-WP-0003-T01
+status: todo
+priority: high
+```
+
+Statute §9.6 attaches different obligations to each class, and the repository
+currently records neither. `ImmuneObservation` carries `source_system` and no
+class; `SecurityGenome` declares no sources at all.
+
+Done when:
+
+- the evidence class is expressible on a declared source and on an observation;
+- `specs/ImmuneContracts.md` states the obligation difference — a load-bearing
+  source MUST declare a cadence, an attributive source SHOULD — and states that
+  the class is the source's declaration, not kings-guard's inference;
+- the `qonto-assistant` fixture declares a class for its audit stream, with the
+  reasoning recorded;
+- tests cover both classes.
+
+## Task: Draft the emission-cadence declaration and hand it to Taxonomy
+
+```task
+id: KG-WP-0003-T02
+status: todo
+priority: high
+```
+
+Statute §17 requires the artifact and records kings-guard as its drafter, being
+its only consumer. Ownership stays with Taxonomy. Inventing a local shape is the
+drift §17 exists to prevent, so this is a draft for handover, not an internal
+schema.
+
+Must cover both forms, because one does not substitute for the other:
+
+- an **expected rate** for volume classes;
+- **reconciliation or a heartbeat** for low-volume load-bearing classes —
+  revocations, denials, containment actions — where rate monitoring cannot work
+  because a suppressed month is indistinguishable from a quiet one. The required
+  property is a positive claim that can itself go missing.
+
+Done when:
+
+- the draft lives in `specs/` and is written against `qonto-assistant` as the
+  one real source;
+- it explains where the declaration belongs — alongside the security genome, on
+  the argument that expected cadence is a claim of intent like the rest of the
+  genome — and why;
+- `GH-WP-0002-T04` is referenced as the reference instance for the heartbeat
+  form;
+- it is sent to gate-house and to the Taxonomy repositories for ownership, and
+  the handover is recorded.
+
+## Task: Evaluate the stream, not only the observation
+
+```task
+id: KG-WP-0003-T03
+status: todo
+priority: high
+```
+
+`PostureEvaluator.evaluate()` is stateless and per-observation. An event that is
+never emitted is never evaluated, so the last posture stands and suppression
+biases posture optimistic. Silence must become a finding in its own right.
+
+Done when:
+
+- a stream-level evaluation path exists alongside the per-observation one;
+- an unmet declared cadence produces a finding;
+- a missing heartbeat, or a reconciliation divergence between the source's own
+  state transitions and the evidence count per class, produces a finding;
+- the findings are distinguishable from content findings — the stream observed,
+  not its contents;
+- no Tooling contact is introduced; the source publishes its own stream.
+
+## Task: Carry stream completeness in the posture output
+
+```task
+id: KG-WP-0003-T04
+status: todo
+priority: high
+```
+
+`confidence_score` starts at 70 and rises with field richness of the record
+received. It measures the record, never the stream: a well-formed observation
+from a 90%-suppressed stream scores 85. The judgment must be able to say *this
+rests on a stream I cannot vouch for.*
+
+Done when:
+
+- completeness is separated from richness in `PostureAssessment`;
+- an unmet cadence or missing heartbeat degrades the completeness dimension;
+- the rationale text says so in words, not only in a number;
+- a posture derived from an incomplete stream can never read as more trustworthy
+  than one derived from a complete one.
+
+## Task: State and test that immune memory is not a state plane
+
+```task
+id: KG-WP-0003-T05
+status: todo
+priority: medium
+```
+
+Statute §3.4 rule 3: agent memory, tool-call traces and prompt caches MUST NOT
+become state another layer depends on at runtime unless catalogued as Tooling.
+`ImmuneMemoryEntry` has no such rule, and `INTENT.md` stage 5 (federated memory)
+is exactly the shape that could drift into one.
+
+Done when:
+
+- `specs/ImmuneContracts.md` states it: immune memory informs kings-guard's own
+  judgment and may be published as evidence; no engine, PEP or workload may read
+  it as a runtime input, and making it one is a §4 Tooling catalog change;
+- a test asserts the constraint rather than leaving it to prose;
+- the constraint is reflected in the `Direction of Evolution` stage-5 entry.
+
+## Task: Make containment proposals reconstructable to their origin
+
+```task
+id: KG-WP-0003-T06
+status: todo
+priority: medium
+```
+
+§9.2 rules that a containment action is a decision record, not a side channel.
+`EffectorRequest` names a target and an action and carries no reference to what
+produced it, so once a proposal leaves this repository it cannot be tied back to
+the observation that caused it.
+
+Done when:
+
+- an effector request carries the originating observation and signal identity;
+- the eventual decision record can name what the proposal was rendered for;
+- `docs/AdjacentSystemBoundary.md` states the expectation on the receiving side;
+- the authority boundary remains explicit and no value widens authority.
+
+## Task: Observe qonto-assistant in operation
+
+```task
+id: KG-WP-0003-T07
+status: todo
+priority: high
+```
+
+Statute §12's fourth step is aspiration until this is done, and §19's verdict
+names kings-guard as the watching half of *can propose and decide but cannot
+watch or act*. Every input today is a hand-built fixture; ten tests pass and
+none has met a real event.
+
+Nothing blocks it. `qonto-assistant` publishes its own genome record and audit
+stream, needs no engine in the path, and its genome has not drifted since it was
+written.
+
+Done when:
+
+- real emitted audit events from `qonto-assistant` reach the evaluator;
+- the observation mapping is confirmed against real events or corrected, and the
+  correction is reported back to `qonto-assistant`;
+- output stays advisory — posture hints and metadata-only evidence, nothing that
+  actuates;
+- the fixture is retained as a regression case rather than deleted;
+- gate-house is told that step four is staffed, with what was found.
+
+## Task: Check the agent-principal rules that can be checked
+
+```task
+id: KG-WP-0003-T08
+status: todo
+priority: medium
+```
+
+All four §3.4 rules are now claimed in `INTENT.md` and none is verified. The
+no-Tooling-client claim showed the pattern: a claim in prose becomes a claim in
+a test, and the test carries the reason.
+
+Done when:
+
+- `scripts/check_layer_conformance.py` covers what is mechanically checkable —
+  at minimum rule 1, no standing credential held in the repository or its
+  configuration;
+- rule 3 is covered by T05;
+- rules that remain assertion rather than test are recorded as such in
+  `layer.yaml`, honestly, rather than implied to be checked;
+- `make check-layer` stays green.
+
+## Success criteria
+
+1. Every task above is `done`.
+2. `make test` and `make check-layer` both pass.
+3. `pyproject.toml` still declares `dependencies = []`.
+4. `INTENT.md` and `SCOPE.md` claim nothing the implementation does not do.
+5. The emission-cadence draft has been handed to Taxonomy and the handover
+   recorded.
+6. gate-house has been told that §12's fourth step is staffed.