Adaptive immune security architecture for netkingdom
tegwick
72c2a42d67
The standard moved v0.4 -> v0.6. All four findings from our v0.4 review were adopted in v0.5, and v0.6 went further on two of them. §11 now requires a machine-readable declaration — prose cannot distinguish a declaration from a transcribed review. We had none. Added layer.yaml (form adapted from ops-warden's reference implementation), scripts/check_layer_conformance.py, and tests/test_layer_conformance.py. The check makes our central claim mechanical rather than asserted: no direct Tooling client in src/. The test exercises the negative case on a synthetic tree, so it fails if the checker goes blind. pyyaml is added as a DEV dependency only — `dependencies = []` is load-bearing for the §5 claim and stays empty. Adopted from v0.6: - containment is no longer ours (§9.2). Actuation is an Engine concept, unowned and held at zero; kings-guard proposes containment and never performs it. The register row is now a dependency, not our gap. - observation is scoped to Staff-reachable sources, with identity and secret observation pending — our finding 1, adopted near-verbatim. - access-engine DECLINED the authentication-evidence gap; owner is now the identity layer plus audit-core, reproposed and unassented. - §11 blocked-clean recorded, with the rule that it must not rank below conforming — our finding 2. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UEtvmYUBP2fDtirJGWn5MW Assistant: claude-code Assistant-Model: opus Assistant-Process: 4014379@bnt-lap001 Assistant-Session: 4af9e20f-1768-4afc-951b-b507784e382b |
||
|---|---|---|
| .repo-manager | ||
| decisions | ||
| docs | ||
| history | ||
| intake | ||
| intakes | ||
| scripts | ||
| specs | ||
| src/kings_guard | ||
| tests | ||
| workplans | ||
| .custodian-brief.md | ||
| .gitignore | ||
| .repo-classification.yaml | ||
| AGENTS.md | ||
| INTENT.md | ||
| layer.yaml | ||
| LICENSE | ||
| Makefile | ||
| pyproject.toml | ||
| README.md | ||
| SCOPE.md | ||
| WORK-RECORDS.md | ||
kings-guard
Adaptive security contracts and posture-evaluation scaffold for NetKingdom's immune-architecture work.
Layer: Staff (NetKingdom Security Layer Model v0.1). kings-guard publishes posture and requests bounded response through engine APIs; it never touches Tooling directly and never renders an authorization decision.
Current slice
This repository now contains four aligned pieces:
INTENT.md/SCOPE.mdfor the repo's stable boundaryspecs/NetKingdomImmuneArchitecture.mdfor the reference architecturespecs/ImmuneContracts.mdfor the first canonical contract layersrc/kings_guard/plustests/for a minimal posture loop scaffold
The current implementation is intentionally narrow. It does not enforce anything. It provides:
- typed contracts for security genome, phenotype, observation, posture, signal, effector request, and immune memory entry;
- a minimal posture evaluator that turns a normalized observation into a posture assessment and bounded response hints;
- a fixture-driven pilot based on
qonto-assistant, chosen because it already exposes a security genome record, an audit stream, and a fast local loop.
Repo layout
specs/NetKingdomImmuneArchitecture.mdspecs/ImmuneContracts.mddocs/AdjacentSystemBoundary.mddocs/pilots/QontoAssistantPosturePilot.mdsrc/kings_guard/tests/workplans/
Dev commands
# preferred, if make + pip are available
make install-dev
make test
make lint
make run-demo
# direct shell fallback used in minimal environments
python3 -m pytest -q
PYTHONPATH=src python3 -m kings_guard.main --pilot qonto-assistant