net-kingdom/workplans/NK-WP-0031-deterministic-posture-feedback.md

---
id: NK-WP-0031
type: workplan
title: "Implement deterministic posture and evidence feedback"
domain: infotech
repo: net-kingdom
status: finished
flavor: residual
owner: codex
topic_slug: netkingdom
planning_priority: P1
created: "2026-08-23"
updated: "2026-10-15"
state_hub_workstream_id: "9d7b04f9-3803-5613-b7a5-8bd606c77f5a"
---

# NK-WP-0031 — Deterministic posture and evidence feedback

Authorized by the operator as the next locally owned increment after
NK-WP-0030. This implements the safe first C6 loop proposed by the 2026-08-23
scope-to-intent assessment: surface explicit drift as proposals without
autonomous policy or work-record mutation.

## Define freshness, owner, and proposal semantics

```task
id: NK-WP-0031-T01
status: done
priority: high
state_hub_task_id: "917f8856-091e-59f9-b9e4-71a8c9a0d029"
```

Extend Tenancy Posture declarations with optional authoritative repository and
evidence-freshness metadata. Define deterministic time, owner resolution,
finding severity, stable identity, and the proposal-only safety boundary.

Implemented in Tenancy Posture draft-14, Posture Feedback v0.1, and their
schemas. Missing authoritative ownership or freshness resolves to `unknown`;
source-path normalization never becomes owner inference.

## Implement the posture feedback evaluator

```task
id: NK-WP-0031-T02
status: done
priority: high
state_hub_task_id: "63486c21-2ca2-5930-bc27-f8acde3eec8f"
```

Validate declarations and emit deterministic JSON findings for overdue/due-soon
reviews, unknown/expired/due-soon evidence, implemented-but-unevidenced levels,
and declared gaps. Require explicit `--as-of`; never perform external writes.

Implemented under `tools/posture-feedback/`. The emitted report declares that
external, policy, and declaration writes are all forbidden.

## Publish reference workflow and tests

```task
id: NK-WP-0031-T03
status: done
priority: high
state_hub_task_id: "0372c168-b34d-5ad5-8315-be3af74758de"
```

Provide an example declaration and cover freshness boundaries, missing owners,
multi-service inputs, stable digests, severity exit thresholds, and invalid
declarations.

The checked-in expired-E2 example yields five deterministic proposals at its
fixed evaluation time. Focused coverage includes every listed boundary plus
portable source identity.

## Obtain audit-core freshness adoption

```task
id: NK-WP-0031-T04
status: done
priority: high
state_hub_task_id: "7d2029d2-db8d-526e-ab73-a0751becb193"
```

Ask `audit-core` to add authoritative owner and E2 freshness metadata for
`WH-ENG-20260822-AUDIT-E2-03`. The evaluator must report its freshness as
unknown until the source declaration supplies the exact timestamps and
replacement action; NetKingdom must not parse them from prose.

Requested in State Hub message `874e5fa5-e05c-4b1a-a915-26c4dba07b87`.
The same estate baseline found pre-existing missing evidence entries for
`railiance-platform` `apps-pg` current R2 and V1; that separate correction was
routed in `d65f8383-bdab-488e-a36f-f8cabd8a5f65`.

## Verify and reconcile

```task
id: NK-WP-0031-T05
status: done
priority: medium
state_hub_task_id: "b646e6a0-20ba-5377-a3d1-7ae92eb9e936"
```

Run focused and repository regression tests, validate schemas and examples,
reconcile State Hub, and publish the implementation evidence.

Verification on 2026-08-23:

- 28 focused posture-feedback and tenancy-validator tests passed;
- 84 root tests passed with the independently packaged `local-identity`
  project excluded, then all 142 `local-identity` tests passed in its own
  environment;
- both JSON schemas parsed, the fixed-time reference target succeeded, and
  `git diff --check` passed;
- reuse-surface validated the capability registry entry; and
- the read-only seven-declaration baseline is recorded in
  `history/2026-08-23-posture-feedback-estate-baseline.md`.

Local implementation was complete on 2026-08-23. T04 adoption completed
2026-10-15; see the closure evidence below.

## Infrastructure review — 2026-09-28

`audit-core/tenancy.yaml` still lacks machine-readable authoritative owner
and E2 freshness metadata. Its E2 prose retains the August 22 receipt and
24-hour replacement deadline; report freshness as `unknown` until the required
fields exist, without renewing that evidence from prose. The September 24
receiver/database recreate evidence supports V1 only and cannot refresh E2.
T04 remains `wait`; request the source declaration update and evaluate it with
an explicit current `--as-of` before closure.

The same declaration still describes flex-auth as unauthenticated A0, whereas
today all six live flex-auth Deployments pass `--caller-auth-mode enforce`.
The audit-core owner should reconcile that rationale against actual caller
bindings and policy evidence; deployment flags alone do not prove a new A level.

Evidence and cross-plan priorities: [estate review](../history/2026-09-28-open-workplan-infrastructure-review.md).

> 2026-10-11: demoted to `flavor: residual` / `backlog` by founder-authorized triage — off the
> critical path (identity → authz → secrets → SecurityCase execution). Tasks are unchanged;
> promote back when demand or risk appears. See the-custodian
> `history/20261011-netkingdom-security-progress-assessment.md`.


## Adoption and closure — 2026-10-15

Founder resumed this workplan after the October 11 triage. All five tasks are
now done. Audit-core's authoritative `tenancy.yaml` publishes its responsible
repository plus `evidence_freshness.E2` with observation, original expiry,
bounded scope, target image digest and replacement action. Source adoption is
recorded in `audit-core/workplans/ADHOC-2026-10-15.md`.

The observation and expiry come from the existing August 22 target receipt
and declaration: `2026-08-22T22:10:25Z` and `2026-08-23T22:10:25Z`.
No evidence was renewed from prose or September recovery exercises. The
posture levels, review dates and evidence references are unchanged.

At explicit `--as-of 2026-10-15T17:27:15Z`, the evaluator changes E2 from
unknown freshness/owner to **expired**, owned by **audit-core**, with the
exact declared replacement action. The existing overdue posture review also
routes to audit-core. All ten findings now have an explicit owner; two high
findings and eight declared gaps remain visible. `--fail-on high` returns
1 as intended; proposal-only reporting does not mutate declarations or policy.

Verification: **28 focused tests passed**, source schema/semantic validation
passed, repeated current-time reports were byte-identical, and source
comparison proves that only the new owner/freshness fields changed. Receipt
and report digests are recorded in the
[adoption evidence](../docs/evidence/2026-10-15-posture-feedback-adoption/adoption.json),
with [before](../docs/evidence/2026-10-15-posture-feedback-adoption/before.json)
and [after](../docs/evidence/2026-10-15-posture-feedback-adoption/after.json) reports.

Fresh E2 production is not part of this completed adoption increment. The
existing live owner work record **AUDIT-WP-0015-T02** remains waiting for
identity/engagement prerequisites and a separately approved new run. It is
not closed or authorized by these metadata changes. No live packets, secret
access, runtime changes or posture-level changes occurred.

Security orientation: Emergent Knowledge 0.2.6, package digest
`8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02`.
`start` and `evidence` were withheld/orientation-only because sources changed;
source cards, current repository instructions, security companion and original
owner evidence were reviewed directly. These receipts confer no live authority.