coulomb/kings-guard
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish KG-WP-0003: stream completeness and live qonto observation

Browse source 
Classify evidence as load-bearing or attributive, draft the emission-cadence
declaration for Taxonomy, treat silence as a stream finding, keep completeness
separate from record richness, forbid immune memory as a state plane, and make
containment proposals reconstructable to their origin. Observe real
qonto-assistant audit events; deny-class completeness stays unknown until the
source publishes a heartbeat.

Assistant: grok
Assistant-Session: 01a05ef1-9e5a-70f2-b0ff-0b05d6b38ae9
This commit is contained in:
tegwick 2026-09-02 00:11:57 +02:00
parent c85646dc3c
commit 9daea96c43
35 changed files with 2023 additions and 138 deletions
Download patch file Download diff file Expand all files Collapse all files

44
src/kings_guard/fixtures/qonto_assistant_cadence.json Normal file
View file

@ -0,0 +1,44 @@
{
"schema_version": "0.1",
"status": "taxonomy-draft",
"drafter": "kings-guard",
"owner": "Taxonomy",
"source": "qonto-assistant",
"belongs_alongside": "security_genome",
"reference_instance": "GH-WP-0002-T04",
"reference_source_declaration": "approval-engine/cadence.yaml",
"sources": [
{
"source_id": "qonto-assistant.audit.allow",
"source_system": "qonto-assistant",
"event_class": "audit.allow",
"evidence_class": "attributive",
"form": "expected-rate",
"window": "24h",
"window_seconds": 86400,
"expected_min": 1,
"drop_below": "finding",
"note": "Worked example of the volume form. qonto-assistant is called sporadically, so this rate is a SHOULD illustration, not a claim that completeness of allows is currently meaningful."
},
{
"source_id": "qonto-assistant.audit.deny",
"source_system": "qonto-assistant",
"event_class": "audit.deny",
"evidence_class": "load-bearing",
"form": "heartbeat-or-reconciliation",
"rate_monitoring": "forbidden",
"heartbeat": {
"event_class": "audit.heartbeat",
"interval": "24h",
"interval_seconds": 86400,
"assertion": "nothing-to-report",
"missing": "finding"
},
"reconciliation": {
"compare_local": "source_transition_counts.audit.deny",
"compare_observed": "evidence_counts.audit.deny",
"divergence": "finding"
}
}
]
}

34
src/kings_guard/fixtures/qonto_assistant_pilot.json
View file

@ -28,6 +28,32 @@
"description": "Actor identity is still self-asserted until key-cape integration lands.",
"effect": "monitor"
}
],
"evidence_sources": [
{
"source_id": "qonto-assistant.audit.allow",
"source_system": "qonto-assistant",
"event_class": "audit.allow",
"evidence_class": "attributive",
"cadence_form": "expected-rate",
"reasoning": "Allow records support forensic reconstruction. No control currently branches on an allow being present or absent, so the class is attributive and completeness is not claimed."
},
{
"source_id": "qonto-assistant.audit.deny",
"source_system": "qonto-assistant",
"event_class": "audit.deny",
"evidence_class": "load-bearing",
"cadence_form": "heartbeat-or-reconciliation",
"reasoning": "qonto-assistant's deny-escalation loop and kings-guard posture both branch on deny presence or absence. Statute §9.6 names denials as load-bearing. The class is this source's declaration, not an inference from the string 'deny'."
},
{
"source_id": "qonto-assistant.audit.heartbeat",
"source_system": "qonto-assistant",
"event_class": "audit.heartbeat",
"evidence_class": "load-bearing",
"cadence_form": "heartbeat-or-reconciliation",
"reasoning": "The positive nothing-to-report claim for the deny class. Rate monitoring cannot work on infrequent denials; the heartbeat is the claim that can itself go missing."
}
]
},
"qonto_audit_event": {
@ -50,9 +76,15 @@
"identity_binding": "self_asserted",
"egress_destination": "qonto-thirdparty-api"
},
"evidence_class_reasoning": [
"audit.deny is load-bearing because deny-escalation and posture branch on it; the source declares that class.",
"audit.allow is attributive: forensic reconstruction only; completeness is not claimed.",
"kings-guard copies the declared class onto the observation and does not infer it from decision=deny."
],
"source_notes": [
"Derived from qonto-assistant/specs/security-genome.yaml",
"Derived from qonto-assistant/src/qonto_assistant/contracts.py#AuditEvent",
"Pilot chooses qonto-assistant because it already ships an audit stream, a genome record, and a fast local loop."
"Pilot chooses qonto-assistant because it already ships an audit stream, a genome record, and a fast local loop.",
"This JSON remains the regression fixture. Live emitted events are captured separately by kings_guard.live."
]
}