kings-guard/workplans/KG-WP-0003-evidence-completeness-and-live-observation.md

---
id: KG-WP-0003
type: workplan
title: "Evidence completeness and live observation"
domain: infotech
repo: kings-guard
status: ready
owner: kings-guard
topic_slug: netkingdom
created: "2026-08-29"
updated: "2026-08-29"
source_review: history/2026-08-29-layer-model-v0.7-scope-intent-review.md
standard: net-kingdom/canon/standards/security-layer-model_v0.7.md
state_hub_workstream_id: "a6c1c760-1386-58fa-9392-d9c3c4dadc41"
---

# Evidence completeness and live observation

Close the gap between what `INTENT.md` and `SCOPE.md` now claim under Security
Layer Model v0.7 and what `src/kings_guard/` actually does. Carries G1–G8 of
`history/2026-08-29-layer-model-v0.7-scope-intent-review.md`.

Two things are being fixed. The repository consumes evidence and treats a quiet
stream as a healthy one, which the statute now forbids (§9.6). And statute §12's
fourth step — *kings-guard observes it in operation* — is unstaffed, because
every input is a fixture.

## Boundaries this workplan does not cross

- **No actuation.** kings-guard proposes containment and never performs it
  (§9.2). T06 makes proposals reconstructable; it does not make them act.
- **No Tooling contact.** `dependencies = []` stays empty; `make check-layer`
  must stay green on every task. `qonto-assistant` publishes its own stream and
  is not a Tooling row, so T07 needs no engine in the path.
- **No engine gap worked around.** Identity and secret observation stay at zero.

## Dependency order

```text
T01 evidence classification
  -> T02 emission-cadence declaration (draft, handed to Taxonomy)
    -> T03 stream-completeness evaluation
      -> T04 completeness in the posture output
T05 immune memory is not a state plane   (independent)
T06 proposals carry their origin          (independent)
T07 live observation                      (independent; makes the rest real)
T08 agent-principal conformance checks    (after T05)
```

## Task: Classify consumed evidence load-bearing or attributive

```task
id: KG-WP-0003-T01
status: todo
priority: high
state_hub_task_id: "dd660dbf-9148-5f35-aa4a-74deb10e6f8a"
```

Statute §9.6 attaches different obligations to each class, and the repository
currently records neither. `ImmuneObservation` carries `source_system` and no
class; `SecurityGenome` declares no sources at all.

Done when:

- the evidence class is expressible on a declared source and on an observation;
- `specs/ImmuneContracts.md` states the obligation difference — a load-bearing
  source MUST declare a cadence, an attributive source SHOULD — and states that
  the class is the source's declaration, not kings-guard's inference;
- the `qonto-assistant` fixture declares a class for its audit stream, with the
  reasoning recorded;
- tests cover both classes.

## Task: Draft the emission-cadence declaration and hand it to Taxonomy

```task
id: KG-WP-0003-T02
status: todo
priority: high
state_hub_task_id: "5b66aec0-a753-5039-bcbe-bc69cf1ad13e"
```

Statute §17 requires the artifact and records kings-guard as its drafter, being
its only consumer. Ownership stays with Taxonomy. Inventing a local shape is the
drift §17 exists to prevent, so this is a draft for handover, not an internal
schema.

Must cover both forms, because one does not substitute for the other:

- an **expected rate** for volume classes;
- **reconciliation or a heartbeat** for low-volume load-bearing classes —
  revocations, denials, containment actions — where rate monitoring cannot work
  because a suppressed month is indistinguishable from a quiet one. The required
  property is a positive claim that can itself go missing.

Done when:

- the draft lives in `specs/` and is written against `qonto-assistant` as the
  one real source;
- it explains where the declaration belongs — alongside the security genome, on
  the argument that expected cadence is a claim of intent like the rest of the
  genome — and why;
- `GH-WP-0002-T04` is referenced as the reference instance for the heartbeat
  form;
- it is sent to gate-house and to the Taxonomy repositories for ownership, and
  the handover is recorded.

## Task: Evaluate the stream, not only the observation

```task
id: KG-WP-0003-T03
status: todo
priority: high
state_hub_task_id: "2cd878c0-8b70-5f2b-9f82-c4d74df5833c"
```

`PostureEvaluator.evaluate()` is stateless and per-observation. An event that is
never emitted is never evaluated, so the last posture stands and suppression
biases posture optimistic. Silence must become a finding in its own right.

Done when:

- a stream-level evaluation path exists alongside the per-observation one;
- an unmet declared cadence produces a finding;
- a missing heartbeat, or a reconciliation divergence between the source's own
  state transitions and the evidence count per class, produces a finding;
- the findings are distinguishable from content findings — the stream observed,
  not its contents;
- no Tooling contact is introduced; the source publishes its own stream.

## Task: Carry stream completeness in the posture output

```task
id: KG-WP-0003-T04
status: todo
priority: high
state_hub_task_id: "73367acf-d888-5acc-ae85-7231a9cbe9fe"
```

`confidence_score` starts at 70 and rises with field richness of the record
received. It measures the record, never the stream: a well-formed observation
from a 90%-suppressed stream scores 85. The judgment must be able to say *this
rests on a stream I cannot vouch for.*

Done when:

- completeness is separated from richness in `PostureAssessment`;
- an unmet cadence or missing heartbeat degrades the completeness dimension;
- the rationale text says so in words, not only in a number;
- a posture derived from an incomplete stream can never read as more trustworthy
  than one derived from a complete one.

## Task: State and test that immune memory is not a state plane

```task
id: KG-WP-0003-T05
status: todo
priority: medium
state_hub_task_id: "d7ed9faf-58ee-59a1-ad1e-b2fcf817317f"
```

Statute §3.4 rule 3: agent memory, tool-call traces and prompt caches MUST NOT
become state another layer depends on at runtime unless catalogued as Tooling.
`ImmuneMemoryEntry` has no such rule, and `INTENT.md` stage 5 (federated memory)
is exactly the shape that could drift into one.

Done when:

- `specs/ImmuneContracts.md` states it: immune memory informs kings-guard's own
  judgment and may be published as evidence; no engine, PEP or workload may read
  it as a runtime input, and making it one is a §4 Tooling catalog change;
- a test asserts the constraint rather than leaving it to prose;
- the constraint is reflected in the `Direction of Evolution` stage-5 entry.

## Task: Make containment proposals reconstructable to their origin

```task
id: KG-WP-0003-T06
status: todo
priority: medium
state_hub_task_id: "98326ed2-ee5f-58ce-9f99-429e621117a6"
```

§9.2 rules that a containment action is a decision record, not a side channel.
`EffectorRequest` names a target and an action and carries no reference to what
produced it, so once a proposal leaves this repository it cannot be tied back to
the observation that caused it.

Done when:

- an effector request carries the originating observation and signal identity;
- the eventual decision record can name what the proposal was rendered for;
- `docs/AdjacentSystemBoundary.md` states the expectation on the receiving side;
- the authority boundary remains explicit and no value widens authority.

## Task: Observe qonto-assistant in operation

```task
id: KG-WP-0003-T07
status: todo
priority: high
state_hub_task_id: "ae516be8-5199-5f81-b47f-7843b5993f97"
```

Statute §12's fourth step is aspiration until this is done, and §19's verdict
names kings-guard as the watching half of *can propose and decide but cannot
watch or act*. Every input today is a hand-built fixture; ten tests pass and
none has met a real event.

Nothing blocks it. `qonto-assistant` publishes its own genome record and audit
stream, needs no engine in the path, and its genome has not drifted since it was
written.

Done when:

- real emitted audit events from `qonto-assistant` reach the evaluator;
- the observation mapping is confirmed against real events or corrected, and the
  correction is reported back to `qonto-assistant`;
- output stays advisory — posture hints and metadata-only evidence, nothing that
  actuates;
- the fixture is retained as a regression case rather than deleted;
- gate-house is told that step four is staffed, with what was found.

## Task: Check the agent-principal rules that can be checked

```task
id: KG-WP-0003-T08
status: todo
priority: medium
state_hub_task_id: "e7003fb3-2e7c-5440-b489-b619b3f0c65d"
```

All four §3.4 rules are now claimed in `INTENT.md` and none is verified. The
no-Tooling-client claim showed the pattern: a claim in prose becomes a claim in
a test, and the test carries the reason.

Done when:

- `scripts/check_layer_conformance.py` covers what is mechanically checkable —
  at minimum rule 1, no standing credential held in the repository or its
  configuration;
- rule 3 is covered by T05;
- rules that remain assertion rather than test are recorded as such in
  `layer.yaml`, honestly, rather than implied to be checked;
- `make check-layer` stays green.

## Success criteria

1. Every task above is `done`.
2. `make test` and `make check-layer` both pass.
3. `pyproject.toml` still declares `dependencies = []`.
4. `INTENT.md` and `SCOPE.md` claim nothing the implementation does not do.
5. The emission-cadence draft has been handed to Taxonomy and the handover
   recorded.
6. gate-house has been told that §12's fourth step is staffed.