92cc6f08a4
Assistant: claude-code Assistant-Model: opus Assistant-Process: 4014379@bnt-lap001 Assistant-Session: 4af9e20f-1768-4afc-951b-b507784e382b
153 lines
6.8 KiB
Markdown
153 lines
6.8 KiB
Markdown
# Decision records
|
|
|
|
## KG-DEC-2026-001 — Assent to Staff placement, release of control-plane vocabulary, and the posture asymmetry
|
|
|
|
```yaml
|
|
id: KG-DEC-2026-001
|
|
kind: decision
|
|
title: Assent to Staff placement, release of control-plane vocabulary, and the posture
|
|
asymmetry
|
|
status: resolved
|
|
owner: Bernd Worsch
|
|
repo: kings-guard
|
|
standard: net-kingdom/canon/standards/security-layer-model_v0.1.md
|
|
origin_ref: KG-IN-0001
|
|
related:
|
|
- gate-house/decisions/decisions.md GH-DEC-2026-001
|
|
- gate-house/history/2026-08-28-security-layer-model-and-gate-house-recut.md
|
|
affects:
|
|
- kings-guard
|
|
- gate-house
|
|
- net-kingdom
|
|
- access-engine
|
|
- secrets-engine
|
|
- user-engine
|
|
created: '2026-08-28'
|
|
updated: '2026-08-28'
|
|
decided_by: Bernd Worsch
|
|
disposition: assent-with-finding
|
|
state_hub_decision_id: "80313094-9b5d-4954-b37b-3313deac6b65"
|
|
```
|
|
|
|
## Context
|
|
|
|
`gate-house` raised intake `KG-IN-0001` asking `kings-guard` to assent to its
|
|
placement in the NetKingdom Security Layer Model v0.1: Staff, not Engine; the
|
|
release of "control plane" as a self-description; and the posture contract with
|
|
its asymmetry. The request explicitly invited challenge to §5 — the binding
|
|
rule — if routing containment through engine APIs proves impractical in a real
|
|
incident.
|
|
|
|
## Decision
|
|
|
|
**Assent to all three points, with one finding against §5 that gate-house
|
|
should rule on.**
|
|
|
|
### 1. Staff placement — assented
|
|
|
|
kings-guard is agentic and non-deterministic. Its outputs are posture
|
|
judgments, typed signals, and bounded requests — not a deterministic result
|
|
from an authoritative input state. It fails the Engine test in §3.3 on its
|
|
defining property, and it fails it by design: intent-versus-behavior judgment
|
|
is inference, and inference is not an authority. Staff is the correct layer,
|
|
and "acting at runtime does not make a repository an Engine" resolves the only
|
|
plausible objection kings-guard had.
|
|
|
|
`INTENT.md` now declares the layer.
|
|
|
|
### 2. Control-plane vocabulary — released
|
|
|
|
"Control plane" is released to the Engine layer. The one-liner, `SCOPE.md`,
|
|
`README.md`, `AGENTS.md`, and the adjacent-system boundary have been reworded:
|
|
kings-guard **judges and proposes; engines decide and act.**
|
|
|
|
We accept the framing that this is not a demotion. It is the same statement as
|
|
the binding rule, read from the other end: a repository that may not reach into
|
|
OpenBao or a cluster directly has no plane to control, and saying so plainly
|
|
removes an overlap that was invisible in this repo's own documents.
|
|
|
|
Residual: `specs/NetKingdomImmuneArchitecture.md` uses "control plane" in
|
|
several places describing an estate-wide arrangement of deterministic
|
|
authorities. A layer note now scopes those readings; the full sweep is handed
|
|
off as intake **KG-IN-0002**.
|
|
|
|
### 3. Posture contract and asymmetry — assented, and already implemented
|
|
|
|
kings-guard **publishes** posture; gate-house defines its authority meaning;
|
|
access-engine renders it. Posture is not a privilege source.
|
|
|
|
The asymmetry — reduce authority, require step-up, request containment; never
|
|
probabilistically manufacture additional authority — is adopted as an invariant
|
|
of this repository, and the scaffold already satisfies it: every
|
|
`EffectorRequest` carries an explicit `authority_boundary`, and the values in
|
|
use are `advisory_only` and `metadata_only`. No code path widens authority.
|
|
|
|
### Conformance at time of assent
|
|
|
|
Per layer model §10, checked and clean:
|
|
|
|
- `pyproject.toml` declares **zero runtime dependencies** — no database driver,
|
|
no OpenBao client, no cluster client. §5 holds mechanically.
|
|
- No module exposes an authorization decision surface. §6 holds.
|
|
- No read-only Tooling observation is claimed, so §5's declared-exception path
|
|
is unused.
|
|
|
|
## Finding — §5 is right, and currently undischargeable for containment
|
|
|
|
gate-house asked whether the binding rule is impractical for containment during
|
|
a real incident. Our answer is **no — do not weaken it** — but the rule has a
|
|
consequence the standard does not yet state.
|
|
|
|
**Do not weaken it.** The three obvious pressures do not survive examination:
|
|
|
|
- *Latency.* The asymmetry means kings-guard's only available actions point in
|
|
the safe direction. A slow authority-reducing call is a slow safe action, not
|
|
a dangerous one. Latency is not a reason to bypass an engine.
|
|
- *Blast radius.* A direct path is wider than an engine call, not narrower.
|
|
The engine is what bounds the radius.
|
|
- *Engine unavailable.* This is the real pressure, and it is exactly where a
|
|
break-glass path is most dangerous. An incident is when an attacker most
|
|
wants the shortcut, and a containment path that bypasses the decision point
|
|
is an authority path in the other direction the moment it is subverted. It
|
|
is the "small convenience" §6 names. We do not want it, and we ask that
|
|
gate-house not grant it to us.
|
|
|
|
**But:** §4 catalogs kings-guard as owning "adaptive defence, observation,
|
|
**containment**", while **no engine exposes a containment surface today** —
|
|
nothing to reduce authority, require step-up, or isolate a workload as a
|
|
deterministic API. Under §5, correctly obeyed, kings-guard's containment
|
|
capability is therefore not degraded but **zero**. The charter in §4 and the
|
|
rule in §5 are consistent in principle and unsatisfiable together in practice
|
|
until that engine surface exists.
|
|
|
|
Two requests to gate-house, either of which resolves it:
|
|
|
|
1. **Rule that a containment capability MUST be engine-exposed before a Staff
|
|
repository may be catalogued as owning containment** — so that §4 does not
|
|
assign a responsibility §5 forbids discharging. Alternatively, mark
|
|
kings-guard's containment claim as pending the engine gap.
|
|
2. **Rule that the degraded-mode fallback belongs inside the engine, not in
|
|
Staff.** If containment must survive partial failure, the deterministic
|
|
"fail to reduced authority" default belongs to `access-engine`, applied when
|
|
it cannot reach its own inputs. That keeps the decision at the decision
|
|
point and keeps the fallback deterministic, which a Staff-layer fallback
|
|
could never be.
|
|
|
|
The three open engine gaps — authentication/assurance evidence, secret-use
|
|
evidence, and the containment surface — are recorded in `INTENT.md` under
|
|
*Declared engine gaps*. Until they close, the corresponding posture lanes stay
|
|
advisory and fixture-driven, which is the honest state and not a workaround.
|
|
|
|
## Consequences
|
|
|
|
- kings-guard declares Staff in `INTENT.md` and stops describing itself as a
|
|
control plane.
|
|
- Evidence from `key-cape` and OpenBao is routed through `user-engine` /
|
|
`access-engine` and `secrets-engine` respectively; the boundary document no
|
|
longer implies a direct read.
|
|
- The `qonto-assistant` pilot is confirmed as the layer-clean lane: it needs no
|
|
Tooling client, because the assistant publishes its own genome and audit
|
|
stream.
|
|
- kings-guard's assent removes one of the two adaptations §11 lists as
|
|
outstanding. The standard remains proposed pending `flex-auth` and
|
|
`ops-warden`.
|