Finish KG-WP-0003: stream completeness and live qonto observation

Classify evidence as load-bearing or attributive, draft the emission-cadence
declaration for Taxonomy, treat silence as a stream finding, keep completeness
separate from record richness, forbid immune memory as a state plane, and make
containment proposals reconstructable to their origin. Observe real
qonto-assistant audit events; deny-class completeness stays unknown until the
source publishes a heartbeat.

Assistant: grok
Assistant-Session: 01a05ef1-9e5a-70f2-b0ff-0b05d6b38ae9

specs/ImmuneContracts.md

@@ -1,9 +1,9 @@
 ---
 title: Kings Guard Immune Contracts
 document_id: KG-CONTRACTS-IMMUNE
-version: 0.1.0
+version: 0.2.0
 status: Draft
-date: 2026-07-23
+date: 2026-09-01
 repo: kings-guard
 classification: Public
 ---
@@ -48,11 +48,36 @@ against statistical surprise.
 `immune_signal` and `effector_request` may recommend or request response, but
 they do not silently acquire authority owned by adjacent systems.
 
-### 2.4 Memory is governed
+### 2.4 Memory is governed and is not a state plane
 
 `immune_memory_entry` records reusable learning without becoming a raw secret
 store or a place to centralize tenant-confidential payloads.
 
+Under statute §3.4 rule 3, immune memory informs kings-guard's own judgment
+and may be published as evidence. No engine, PEP, or workload may read it as
+a runtime input. Making it one is a §4 Tooling catalog change, not a quiet
+integration. The reference type carries
+`runtime_input_for_other_layers: forbidden`.
+
+### 2.5 Evidence class is declared, not inferred
+
+Statute §9.6 attaches different obligations to load-bearing and attributive
+evidence. The class is the **source's declaration**, recorded on the
+`security_genome`'s `evidence_sources` and copied onto each
+`immune_observation`. kings-guard does not infer the class from event
+contents.
+
+Obligation difference:
+
+| Class | Cadence | Completeness |
+| --- | --- | --- |
+| **Load-bearing** | MUST declare a cadence. Volume classes use expected rate. Low-volume classes (revocations, denials, containment) use heartbeat or reconciliation — rate monitoring is the wrong form. | Absence of a required event, unmet cadence, missing heartbeat, or reconciliation divergence is a finding about the stream. |
+| **Attributive** | SHOULD declare a cadence. Atomicity SHOULD be sought; a deliberate trade-away MUST be declared. | Completeness MUST NOT be claimed where atomicity was traded away. |
+
+The emission-cadence declaration itself is a Taxonomy artifact (§17).
+kings-guard drafts it and consumes it; it does not own it. See
+`specs/EmissionCadenceDeclaration.md`.
+
 ## 3. Contract Map
 
 | Contract | Meaning | Typical producers | Typical consumers |
@@ -81,7 +106,10 @@ Minimum fields in v0.1:
 - permitted capability scope;
 - permitted protocols and egress destinations;
 - data classifications;
-- declared tolerances.
+- declared tolerances;
+- declared evidence sources, each with an evidence class (load-bearing or
+  attributive) and optional cadence form. The class is the source's
+  declaration.
 
 Produced by:
 
@@ -107,6 +135,8 @@ Minimum fields in v0.1:
 - capability or resource scope;
 - protocol;
 - decision/outcome;
+- evidence class, copied from the source declaration;
+- event class (for example `audit.deny`, `audit.allow`, `audit.heartbeat`);
 - optional deny reason, identity-binding mode, egress destination, and policy
   version.
 
@@ -153,9 +183,19 @@ Minimum fields in v0.1:
 
 - posture level (`healthy`, `elevated`, `inflamed`, `compromised`);
 - risk score;
-- confidence score;
+- confidence score — richness of the **record** received, never of the stream;
+- stream completeness (`complete`, `degraded`, `unknown`) and a reason in
+  words — an unmet cadence or missing heartbeat degrades this dimension, and
+  a posture derived from an incomplete stream can never read as more
+  trustworthy than one derived from a complete one;
 - findings and tolerated findings;
-- human-readable rationale.
+- human-readable rationale, which must state completeness in words, not only
+  as a number.
+
+Stream findings (`stream:cadence_unmet`, `stream:heartbeat_missing`,
+`stream:reconciliation_divergence`) are findings about the stream observed,
+not about a record's contents. They MUST be distinguishable from content
+findings such as `credential_exfil_probe`.
 
 Produced by:
 
@@ -202,7 +242,16 @@ Minimum fields in v0.1:
 - action name;
 - authority boundary;
 - reason;
-- whether human approval is required.
+- whether human approval is required;
+- originating observation identifier;
+- originating signal identifier;
+- stream-completeness state at emission;
+- requested restrictive direction (`reduce_authority`, `require_step_up`,
+  `request_containment`, or `none`).
+
+These origin fields exist so the eventual decision record can name what the
+proposal was rendered for (§9.2). They do not widen authority. A containment
+proposal is not an authorization; kings-guard never actuates.
 
 Produced by:
 
@@ -244,7 +293,8 @@ Minimum fields in v0.1:
 - summary;
 - records it was derived from;
 - recommended countermeasures;
-- confidentiality class.
+- confidentiality class;
+- `runtime_input_for_other_layers`, which is `forbidden`.
 
 Produced by:
 
@@ -253,9 +303,14 @@ Produced by:
 
 Consumed by:
 
-- future contract revisions;
-- policy authors;
-- future cross-run learning surfaces.
+- kings-guard's own later judgment;
+- published evidence surfaces.
+
+Not consumed by:
+
+- any engine, PEP, or workload as a runtime input. That would make immune
+  memory a state plane, which §3.4 rule 3 forbids unless the memory is
+  catalogued as Tooling under §4.
 
 ## 5. Current Reference Slice