Finish KG-WP-0003: stream completeness and live qonto observation

Classify evidence as load-bearing or attributive, draft the emission-cadence
declaration for Taxonomy, treat silence as a stream finding, keep completeness
separate from record richness, forbid immune memory as a state plane, and make
containment proposals reconstructable to their origin. Observe real
qonto-assistant audit events; deny-class completeness stays unknown until the
source publishes a heartbeat.

Assistant: grok
Assistant-Session: 01a05ef1-9e5a-70f2-b0ff-0b05d6b38ae9

specs/EmissionCadenceDeclaration.md

@@ -0,0 +1,134 @@
+---
+title: Emission-cadence declaration (Taxonomy draft)
+document_id: KG-DRAFT-EMISSION-CADENCE
+version: 0.1.0
+status: Draft-for-handover
+date: 2026-09-01
+drafter: kings-guard
+owner: Taxonomy
+worked_example: qonto-assistant
+reference_instance: GH-WP-0002-T04
+reference_source_declaration: approval-engine/cadence.yaml
+statute: net-kingdom/canon/standards/security-layer-model_v0.7.md
+sections: ["9.6", "17"]
+classification: Public
+---
+
+# Emission-cadence declaration — Taxonomy draft
+
+kings-guard drafts this artifact because it is the only consumer of
+silence-as-signal and cannot implement §9.6 without a declared cadence.
+**Ownership stays with Taxonomy.** This file is a handover, not an internal
+schema. Inventing a local shape and keeping it here would be the drift
+§17 exists to prevent.
+
+Proposed Taxonomy homes, neither of which has assented (§17):
+
+- `info-tech-canon` — ecosystem-wide semantic contracts
+- `net-kingdom` — NetKingdom standards of record
+
+gate-house already named the heartbeat form as doctrine in
+`docs/contracts/approval-emission-detection.md` (`GH-WP-0002-T04`). The
+reference source declaration is `approval-engine/cadence.yaml`. This draft
+covers **both** forms, because one does not substitute for the other.
+
+## 1. Why this belongs alongside the security genome
+
+A source already declares intended healthy operation as a `security_genome`:
+purpose, permitted capabilities, egress, tolerances. Expected emission cadence
+is a claim of the same kind — a statement of intent about the evidence the
+source will publish, not a measurement kings-guard takes of it.
+
+Putting the declaration next to the genome keeps three properties:
+
+1. **The class is the source's declaration.** Load-bearing versus attributive
+   is not inferred by the observer from event contents.
+2. **The form follows the class.** Volume classes declare an expected rate.
+   Low-volume load-bearing classes declare a heartbeat or reconciliation.
+   Rate monitoring is forbidden for the latter: a suppressed month of
+   revocations is indistinguishable from a quiet one.
+3. **Silence becomes observable without Tooling contact.** The source
+   publishes the stream, including the positive claim that can itself go
+   missing. kings-guard compares what arrived against what was declared.
+
+## 2. Both forms
+
+### 2.1 Expected rate — volume classes
+
+Use when the class has a rate that can drop.
+
+```yaml
+form: expected-rate
+event_class: <name>
+evidence_class: attributive | load-bearing
+window: 24h
+expected_min: <integer>
+drop_below: finding
+```
+
+A drop below `expected_min` in `window` is a finding about the **stream**,
+not about any record's contents.
+
+Load-bearing volume classes MUST declare this form (or the heartbeat form
+if they are in fact low-volume). Attributive sources SHOULD.
+
+### 2.2 Heartbeat or reconciliation — low-volume load-bearing classes
+
+Use when the valuable event is rare: revocations, denials, containment
+actions. Rate monitoring cannot work. The required property is a **positive
+claim that can itself go missing**.
+
+Reference instance: `GH-WP-0002-T04` / `approval-engine/cadence.yaml`.
+Form is heartbeat **plus** reconciliation, not rate monitoring.
+
+```yaml
+form: heartbeat-or-reconciliation
+event_class: <name>
+evidence_class: load-bearing
+rate_monitoring: forbidden
+heartbeat:
+  event_class: <name>.heartbeat   # or a dedicated heartbeat class
+  interval: 24h
+  assertion: nothing-to-report
+  missing: finding
+reconciliation:
+  compare_local: source transition counts per class
+  compare_observed: evidence-engine counts per class
+  divergence: finding
+  undrained_local: lag-not-divergence
+```
+
+A missing heartbeat, or a reconciliation divergence, is a finding about the
+stream. None of these are informational logs.
+
+## 3. Worked example — `qonto-assistant`
+
+The one real source this draft is written against.
+
+| Event class | Evidence class | Form | Why |
+| --- | --- | --- | --- |
+| `audit.allow` | attributive | expected-rate (SHOULD) | Forensic reconstruction; no control branches on presence. Completeness is not claimed. The rate row is here so the volume form is specified, not because qonto traffic is currently a meaningful volume class. |
+| `audit.deny` | load-bearing | heartbeat-or-reconciliation (MUST) | Deny-escalation and posture branch on deny presence/absence. Statute §9.6 names denials as load-bearing. Denials are infrequent, so rate monitoring is the wrong form. |
+| `audit.heartbeat` | load-bearing | the positive claim | `nothing-to-report` plus per-class counts since the previous heartbeat. |
+
+Machine-readable worked example consumed by the local evaluator (draft-shaped,
+not a competing schema): `src/kings_guard/fixtures/qonto_assistant_cadence.json`.
+
+Until `qonto-assistant` publishes the declaration and emits heartbeats, no
+argument may assume this surface is live on that source. kings-guard can
+still observe the audit events it does emit; stream completeness for the
+deny class stays `unknown` or `degraded` until the positive claim exists.
+
+## 4. Consumer obligations (kings-guard)
+
+- Copy the declared evidence class onto each observation; do not infer it.
+- Evaluate the stream against the declaration, not only each record.
+- Carry completeness separately from record richness in posture output.
+- Treat stream findings as distinct from content findings.
+- Open no Tooling client to obtain the stream. The source publishes it.
+
+## 5. Handover
+
+Sent to `gate-house`, `net-kingdom`, and `info-tech-canon` for ownership.
+kings-guard will consume whatever Taxonomy publishes; it will not fork this
+draft into a private schema.

specs/ImmuneContracts.md

@@ -1,9 +1,9 @@
 ---
 title: Kings Guard Immune Contracts
 document_id: KG-CONTRACTS-IMMUNE
-version: 0.1.0
+version: 0.2.0
 status: Draft
-date: 2026-07-23
+date: 2026-09-01
 repo: kings-guard
 classification: Public
 ---
@@ -48,11 +48,36 @@ against statistical surprise.
 `immune_signal` and `effector_request` may recommend or request response, but
 they do not silently acquire authority owned by adjacent systems.
 
-### 2.4 Memory is governed
+### 2.4 Memory is governed and is not a state plane
 
 `immune_memory_entry` records reusable learning without becoming a raw secret
 store or a place to centralize tenant-confidential payloads.
 
+Under statute §3.4 rule 3, immune memory informs kings-guard's own judgment
+and may be published as evidence. No engine, PEP, or workload may read it as
+a runtime input. Making it one is a §4 Tooling catalog change, not a quiet
+integration. The reference type carries
+`runtime_input_for_other_layers: forbidden`.
+
+### 2.5 Evidence class is declared, not inferred
+
+Statute §9.6 attaches different obligations to load-bearing and attributive
+evidence. The class is the **source's declaration**, recorded on the
+`security_genome`'s `evidence_sources` and copied onto each
+`immune_observation`. kings-guard does not infer the class from event
+contents.
+
+Obligation difference:
+
+| Class | Cadence | Completeness |
+| --- | --- | --- |
+| **Load-bearing** | MUST declare a cadence. Volume classes use expected rate. Low-volume classes (revocations, denials, containment) use heartbeat or reconciliation — rate monitoring is the wrong form. | Absence of a required event, unmet cadence, missing heartbeat, or reconciliation divergence is a finding about the stream. |
+| **Attributive** | SHOULD declare a cadence. Atomicity SHOULD be sought; a deliberate trade-away MUST be declared. | Completeness MUST NOT be claimed where atomicity was traded away. |
+
+The emission-cadence declaration itself is a Taxonomy artifact (§17).
+kings-guard drafts it and consumes it; it does not own it. See
+`specs/EmissionCadenceDeclaration.md`.
+
 ## 3. Contract Map
 
 | Contract | Meaning | Typical producers | Typical consumers |
@@ -81,7 +106,10 @@ Minimum fields in v0.1:
 - permitted capability scope;
 - permitted protocols and egress destinations;
 - data classifications;
-- declared tolerances.
+- declared tolerances;
+- declared evidence sources, each with an evidence class (load-bearing or
+  attributive) and optional cadence form. The class is the source's
+  declaration.
 
 Produced by:
 
@@ -107,6 +135,8 @@ Minimum fields in v0.1:
 - capability or resource scope;
 - protocol;
 - decision/outcome;
+- evidence class, copied from the source declaration;
+- event class (for example `audit.deny`, `audit.allow`, `audit.heartbeat`);
 - optional deny reason, identity-binding mode, egress destination, and policy
   version.
 
@@ -153,9 +183,19 @@ Minimum fields in v0.1:
 
 - posture level (`healthy`, `elevated`, `inflamed`, `compromised`);
 - risk score;
-- confidence score;
+- confidence score — richness of the **record** received, never of the stream;
+- stream completeness (`complete`, `degraded`, `unknown`) and a reason in
+  words — an unmet cadence or missing heartbeat degrades this dimension, and
+  a posture derived from an incomplete stream can never read as more
+  trustworthy than one derived from a complete one;
 - findings and tolerated findings;
-- human-readable rationale.
+- human-readable rationale, which must state completeness in words, not only
+  as a number.
+
+Stream findings (`stream:cadence_unmet`, `stream:heartbeat_missing`,
+`stream:reconciliation_divergence`) are findings about the stream observed,
+not about a record's contents. They MUST be distinguishable from content
+findings such as `credential_exfil_probe`.
 
 Produced by:
 
@@ -202,7 +242,16 @@ Minimum fields in v0.1:
 - action name;
 - authority boundary;
 - reason;
-- whether human approval is required.
+- whether human approval is required;
+- originating observation identifier;
+- originating signal identifier;
+- stream-completeness state at emission;
+- requested restrictive direction (`reduce_authority`, `require_step_up`,
+  `request_containment`, or `none`).
+
+These origin fields exist so the eventual decision record can name what the
+proposal was rendered for (§9.2). They do not widen authority. A containment
+proposal is not an authorization; kings-guard never actuates.
 
 Produced by:
 
@@ -244,7 +293,8 @@ Minimum fields in v0.1:
 - summary;
 - records it was derived from;
 - recommended countermeasures;
-- confidentiality class.
+- confidentiality class;
+- `runtime_input_for_other_layers`, which is `forbidden`.
 
 Produced by:
 
@@ -253,9 +303,14 @@ Produced by:
 
 Consumed by:
 
-- future contract revisions;
-- policy authors;
-- future cross-run learning surfaces.
+- kings-guard's own later judgment;
+- published evidence surfaces.
+
+Not consumed by:
+
+- any engine, PEP, or workload as a runtime input. That would make immune
+  memory a state plane, which §3.4 rule 3 forbids unless the memory is
+  catalogued as Tooling under §4.
 
 ## 5. Current Reference Slice