Adaptive immune security architecture for netkingdom
tegwick
0fb7b8df4b
Three gate-house messages from 2026-09-05/06 and flex-auth's 2026-09-21 correction had gone unanswered for three weeks. Assent to §9.5 at v0.8 (KG-DEC-2026-004), scoped to the boundary at net-kingdom@66eeaba rather than to v0.8 as a whole, so an assent round held open over §11 does not read as §9.5 unsettled. The criteria-grounding clause gate-house added is assented and its reversal falsifier was attacked against the two real candidates this repository holds — an assertion-form §3.4 check and a readiness row grounded on another repository's decision. It did not fire. §12 step four: the normative sentence stands, kings-guard has still observed nothing in production and KG-WP-0005-T03 waits on the runtime owner. Its supporting sentence has drifted in our favour and is reported against ourselves, with narrower wording proposed. §11 declaration form: INTENT.md says Staff, layer.yaml says staff, and §11 does not say which governs. Neither file is changed — gate-house holds precedence and case sensitivity. Recorded as KG-IN-0007 with the position in layer.yaml rather than left as a silence. KG-IN-0008 declines the catalog reading that exempts published posture from the new §11 emission-guarantee check. Commentary: docs/StatuteV08Review.md (KG-COM-0002), marked derived per the rule v0.8 itself adds. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 63291@bnt-lap001 Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703 |
||
|---|---|---|
| .repo-manager | ||
| decisions | ||
| docs | ||
| history | ||
| intake | ||
| intakes | ||
| scripts | ||
| specs | ||
| src/kings_guard | ||
| tests | ||
| workplans | ||
| .custodian-brief.md | ||
| .gitignore | ||
| .repo-classification.yaml | ||
| AGENTS.md | ||
| INTENT.md | ||
| layer.yaml | ||
| LICENSE | ||
| Makefile | ||
| pyproject.toml | ||
| README.md | ||
| SCOPE.md | ||
| WORK-RECORDS.md | ||
kings-guard
Adaptive security contracts and posture-evaluation scaffold for NetKingdom's immune-architecture work.
Layer: Staff (NetKingdom Security Layer Model v0.7). kings-guard publishes posture and requests bounded response through engine APIs; it never touches Tooling directly and never renders an authorization decision. It proposes containment and does not perform it.
Current slice
This repository now contains four aligned pieces:
INTENT.md/SCOPE.mdfor the repo's stable boundaryspecs/NetKingdomImmuneArchitecture.mdfor the reference architecturespecs/ImmuneContracts.mdfor the first canonical contract layersrc/kings_guard/plustests/for a minimal posture loop scaffold
The current implementation is intentionally narrow. It does not enforce anything. It provides:
- typed contracts for security genome, phenotype, observation, posture, signal, effector request, and immune memory entry;
- evidence-class and stream-completeness fields, so silence is a finding and record richness is not mistaken for a complete stream;
- a posture evaluator that judges one observation and, separately, the stream it came from;
- a
qonto-assistantpilot that still has a fixture regression case and can also consume real events from that service's own AuditLogger.
Repo layout
specs/NetKingdomImmuneArchitecture.mdspecs/ImmuneContracts.mddocs/AdjacentSystemBoundary.mddocs/pilots/QontoAssistantPosturePilot.mdsrc/kings_guard/tests/workplans/
Dev commands
# preferred, if make + pip are available
make install-dev
make test
make lint
make run-demo
# direct shell fallback used in minimal environments
python3 -m pytest -q
PYTHONPATH=src python3 -m kings_guard.main --pilot qonto-assistant