feat(posture): add deterministic feedback proposals

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb

workplans/NK-WP-0031-deterministic-posture-feedback.md

@@ -0,0 +1,111 @@
+---
+id: NK-WP-0031
+type: workplan
+title: "Implement deterministic posture and evidence feedback"
+domain: infotech
+repo: net-kingdom
+status: blocked
+owner: codex
+topic_slug: netkingdom
+planning_priority: P1
+created: "2026-08-23"
+updated: "2026-08-23"
+---
+
+# NK-WP-0031 — Deterministic posture and evidence feedback
+
+Authorized by the operator as the next locally owned increment after
+NK-WP-0030. This implements the safe first C6 loop proposed by the 2026-08-23
+scope-to-intent assessment: surface explicit drift as proposals without
+autonomous policy or work-record mutation.
+
+## Define freshness, owner, and proposal semantics
+
+```task
+id: NK-WP-0031-T01
+status: done
+priority: high
+```
+
+Extend Tenancy Posture declarations with optional authoritative repository and
+evidence-freshness metadata. Define deterministic time, owner resolution,
+finding severity, stable identity, and the proposal-only safety boundary.
+
+Implemented in Tenancy Posture draft-14, Posture Feedback v0.1, and their
+schemas. Missing authoritative ownership or freshness resolves to `unknown`;
+source-path normalization never becomes owner inference.
+
+## Implement the posture feedback evaluator
+
+```task
+id: NK-WP-0031-T02
+status: done
+priority: high
+```
+
+Validate declarations and emit deterministic JSON findings for overdue/due-soon
+reviews, unknown/expired/due-soon evidence, implemented-but-unevidenced levels,
+and declared gaps. Require explicit `--as-of`; never perform external writes.
+
+Implemented under `tools/posture-feedback/`. The emitted report declares that
+external, policy, and declaration writes are all forbidden.
+
+## Publish reference workflow and tests
+
+```task
+id: NK-WP-0031-T03
+status: done
+priority: high
+```
+
+Provide an example declaration and cover freshness boundaries, missing owners,
+multi-service inputs, stable digests, severity exit thresholds, and invalid
+declarations.
+
+The checked-in expired-E2 example yields five deterministic proposals at its
+fixed evaluation time. Focused coverage includes every listed boundary plus
+portable source identity.
+
+## Obtain audit-core freshness adoption
+
+```task
+id: NK-WP-0031-T04
+status: wait
+priority: high
+```
+
+Ask `audit-core` to add authoritative owner and E2 freshness metadata for
+`WH-ENG-20260822-AUDIT-E2-03`. The evaluator must report its freshness as
+unknown until the source declaration supplies the exact timestamps and
+replacement action; NetKingdom must not parse them from prose.
+
+Requested in State Hub message `874e5fa5-e05c-4b1a-a915-26c4dba07b87`.
+The same estate baseline found pre-existing missing evidence entries for
+`railiance-platform` `apps-pg` current R2 and V1; that separate correction was
+routed in `d65f8383-bdab-488e-a36f-f8cabd8a5f65`.
+
+## Verify and reconcile
+
+```task
+id: NK-WP-0031-T05
+status: done
+priority: medium
+```
+
+Run focused and repository regression tests, validate schemas and examples,
+reconcile State Hub, and publish the implementation evidence.
+
+Verification on 2026-08-23:
+
+- 28 focused posture-feedback and tenancy-validator tests passed;
+- 84 root tests passed with the independently packaged `local-identity`
+  project excluded, then all 142 `local-identity` tests passed in its own
+  environment;
+- both JSON schemas parsed, the fixed-time reference target succeeded, and
+  `git diff --check` passed;
+- reuse-surface validated the capability registry entry; and
+- the read-only seven-declaration baseline is recorded in
+  `history/2026-08-23-posture-feedback-estate-baseline.md`.
+
+Local implementation is complete. The workplan remains blocked only on T04's
+externally owned audit-core declaration adoption.