feat(posture): add deterministic feedback proposals

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb

tools/tenancy-posture/test_validate.py

@@ -89,6 +89,41 @@ class SemanticValidationTests(unittest.TestCase):
         document["tenancy"]["review_due"] = "2026-08-16"
         self.assertIn("review_due precedes reviewed", self.validate(document)[0])
 
+    def test_evidence_freshness_must_reference_evidence_key(self) -> None:
+        document = declaration()
+        document["evidence_freshness"] = {
+            "E2": {
+                "kind": "adversarial",
+                "observed_at": "2026-08-22T22:10:25Z",
+                "valid_until": "2026-08-23T22:10:25Z",
+                "responsible_repo": "example",
+                "scope": "bounded tenant probes",
+                "remediation": "repeat the bounded run",
+            }
+        }
+        self.assertIn(
+            "evidence_freshness E2 has no evidence entry",
+            self.validate(document)[0],
+        )
+
+    def test_evidence_freshness_expiry_must_follow_observation(self) -> None:
+        document = declaration()
+        document["evidence"] = {"E2": "docs/evidence/e2.md"}
+        document["evidence_freshness"] = {
+            "E2": {
+                "kind": "adversarial",
+                "observed_at": "2026-08-22T22:10:25Z",
+                "valid_until": "2026-08-22T22:10:25Z",
+                "responsible_repo": "example",
+                "scope": "bounded tenant probes",
+                "remediation": "repeat the bounded run",
+            }
+        }
+        self.assertIn(
+            "valid_until must be after observed_at",
+            self.validate(document)[0],
+        )
+
     def test_service_names_are_unique(self) -> None:
         entry = declaration()
         document = {