feat(posture): add deterministic feedback proposals

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb

SCOPE.md

@@ -44,6 +44,8 @@ about the current implementation.
   selection/parameterization and Railiance execution.
 - Security Scenario Composition v0.1 for deterministic provider selection,
   trust ordering, responsibility mapping, and non-executing owner handoff.
+- Posture Feedback v0.1 for deterministic, proposal-only routing of posture
+  review, evidence-freshness, implementation, and declared-gap findings.
 - Tenancy Posture v0.1 and Security Zones v0.1 proposed standards, their schemas,
   validators, evidence rules, and publication stewardship. Zone semantics are
   owned by `zone-engine`; NetKingdom owns their canon publication.
@@ -54,11 +56,13 @@ about the current implementation.
 
 - `local-identity/`: minimal file-backed OIDC identity for bootstrap,
   development, test, and sandbox use.
-- IAM Profile, playbook-capability, tenancy-posture, custody, evidence, and
-  bootstrap-policy validators.
+- IAM Profile, playbook-capability, tenancy-posture, posture-feedback, custody,
+  evidence, and bootstrap-policy validators.
 - `tools/security-scenario-composer/`: fail-closed, plan-only composition of
   declared capabilities, parameters, trust transitions, responsibilities, and
   readiness obligations.
+- `tools/posture-feedback/`: deterministic, time-explicit remediation proposals
+  with authoritative owner resolution and no external or policy writes.
 - `tools/security-bootstrap-console/`: guarded platform-root and OpenBao
   bootstrap workflow, including refusal of unsafe live initialization.
 - SOPS/age bootstrap integration, credential-generation and rotation helpers,
@@ -110,14 +114,16 @@ repositories while NetKingdom retains the contracts and reference evidence.
 | C3 — Runtime secrets | OpenBao custody, bootstrap, policy, delivery, and recovery contracts | Integrated with an externally deployed runtime; production evidence remains gated |
 | C4 — Fine-grained authorization | flex-auth caller identity and boundary integration | Partially delivered; full estate/PDP readiness is not established here |
 | C5 — Enterprise federation | Keycloak/SAML/enterprise-IdP design | Backlog; not a current provided runtime capability |
-| C6 — Self-optimizing security | Declarations, validators, evidence freshness, workplans, and drift surfacing | Early governance mechanisms only; no autonomous closed loop |
+| C6 — Self-optimizing security | Declarations, validators, evidence freshness, and deterministic owner-routed remediation proposals | First proposal-only feedback loop delivered; no autonomous policy mutation or closed loop |
 
 Current open work as of 2026-08-23 is either externally blocked, date-gated, or
 explicit backlog: reef carrier/public-classification decisions in NK-WP-0027,
 the NK-WP-0022 retirement gate, security tutorials in NK-WP-0009, and
 enterprise federation in NK-WP-0011. NK-WP-0030 has delivered the local C0
 scenario-composition slice and waits for externally owned C1/C2 provider
-declarations before the lightweight SSO scenario can compose.
+declarations before the lightweight SSO scenario can compose. NK-WP-0031 has
+delivered the local proposal-only feedback evaluator and waits for authoritative
+freshness adoption by `audit-core`.
 
 ---
 
@@ -126,8 +132,8 @@ declarations before the lightweight SSO scenario can compose.
 - Defining or reviewing identity, tenancy, workload-zone, credential, and
   security-composition canon.
 - Bootstrapping identity and trust before the normal platform is available.
-- Validating an IAM issuer, posture declaration, or Railiance capability
-  declaration against NetKingdom contracts.
+- Validating an IAM issuer, posture declaration, posture feedback report, or
+  Railiance capability declaration against NetKingdom contracts.
 - Integrating KeyCape, flex-auth, OpenBao, user-engine, tenant-engine, or a
   Railiance package across an explicit security boundary.
 - Deciding which repository owns a security semantic, runtime, deployment, or
@@ -151,15 +157,15 @@ declarations before the lightweight SSO scenario can compose.
 ```capability
 type: governance
 title: NetKingdom security canon
-description: Provider-neutral IAM v0.3, user/tenant boundaries, credential, playbook and scenario composition, tenancy-posture, and workload-zone standards with explicit ownership and conformance rules.
+description: Provider-neutral IAM v0.3, user/tenant boundaries, credential, playbook and scenario composition, tenancy-posture, posture-feedback, and workload-zone standards with explicit ownership and conformance rules.
 keywords: [iam, oidc, tenancy, workload-identity, security-zones, credentials, canon]
 ```
 
 ```capability
 type: validation
 title: Security contract conformance
-description: Executable validation for IAM Profile issuers, playbook capability declarations, tenancy posture, bootstrap custody, and non-secret evidence records.
-keywords: [validation, conformance, iam, posture, evidence, playbooks]
+description: Executable validation for IAM Profile issuers, playbook capability declarations, tenancy posture, deterministic proposal-only feedback, bootstrap custody, and non-secret evidence records.
+keywords: [validation, conformance, iam, posture, feedback, evidence, playbooks]
 ```
 
 ```capability
@@ -192,5 +198,5 @@ keywords: [meta-orchestration, railiance, responsibility, capability, trust-stat
   `tools/security-bootstrap-console/`
 - Executable surfaces: `local-identity/`, `tools/iam-profile-conformance/`,
   `tools/playbook-capability-contract/`, `tools/security-scenario-composer/`,
-  and `tools/tenancy-posture/`
+  `tools/tenancy-posture/`, and `tools/posture-feedback/`
 - Work state: `.custodian-brief.md` and `workplans/`