Correct v0.8 §11: the emission-guarantee check contradicted the profile it cites

gate-house circulated v0.8 with two questions for this repository as owner of
the NetKingdom emission-cadence security profile: whether §17's ownership
paragraph reads in our own voice, and whether §11's new conformance item
follows the profile or diverges from it.

§17 is confirmed as written. It assigns the generic EmissionCadenceDeclaration
contract to info-tech-canon and to net-kingdom the MUST/SHOULD split, the
rare-class rate-monitoring prohibition, and the heartbeat-plus-reconciliation
obligation — which is emission-cadence-security-profile_v0.1.md §3, conjunction
included. No change.

§11 diverged in both directions and is corrected. Requiring a detection surface
of "heartbeat or reconciliation" of every load-bearing source withholds from a
volume class the expected-rate form the profile permits, and accepts for a rare
class either control alone where the profile — and the checker in
tools/emission-cadence-profile — require both. A rare class covered by a
heartbeat alone has no reconciliation to catch divergence, and one covered by
reconciliation alone produces no claim that can go missing, which is the whole
reason §9.6 rejects rate monitoring there. The item also contradicted its own
following paragraph, which admits rate monitoring except where the class is
rare.

The check now defers the form to the governing profile rather than restating a
split that is §17's to assign, carries the volume/rare distinction explicitly,
and states that classification is the source's published inventory and never the
checker's to infer from a name, payload, or observed rate — otherwise omission
detection is circular.

Change log item 6 and §14 record the review. The standard stays proposed;
publication and the acceptance flip wait on the close of the circulation round.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ek3zTdfMa35bPVDjVUyhxx

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 868701@bnt-lap001
Assistant-Session: b2e101b6-f501-40dc-9ee5-438cac36e21a

canon/standards/security-layer-model_v0.8.md

@@ -9,8 +9,8 @@ supersedes: canon/standards/security-layer-model_v0.7.md
 owner: gate-house
 publication_owner: net-kingdom
 created: "2026-08-28"
-updated: "2026-09-06"
-last_reviewed: "2026-09-06"
+updated: "2026-09-07"
+last_reviewed: "2026-09-07"
 review_interval: 3m
 source_revision: "gate-house@516ed4e"
 standard_token: security-layer-model_v0.8
@@ -1101,10 +1101,19 @@ Mechanically checkable:
   a `declared-gap` mark;
 - every repository catalogued in §4 as a source of evidence declares its
   **emission guarantee** in its machine-readable layer declaration: for a
-  **load-bearing** source, a local transactional outbox (§9.4) plus a detection
-  surface — heartbeat or reconciliation, per §9.6 — and its declared cadence;
-  for an **attributive** source, the trade it makes and an explicit statement
-  that completeness is not claimed;
+  **load-bearing** source, a local transactional outbox (§9.4), its declared
+  cadence, and the detection surface the governing cadence profile requires for
+  that class — under `net-kingdom`'s
+  `emission-cadence-security-profile_v0.1.md`, a **volume** load-bearing class
+  MAY be covered by rate monitoring where the source has classified it as
+  suitable, with a positive window and a positive minimum; a **rare**
+  load-bearing class MUST NOT be, and MUST carry a heartbeat **and**
+  reconciliation, not either alone; for an **attributive** source, the trade it
+  makes and an explicit statement that completeness is not claimed. Which class
+  an event falls in, and whether it is rare, is the source's published
+  classification: a conformance run is supplied that inventory and MUST NOT
+  infer it from an event name, payload, or observed rate, or the check becomes
+  circular;
 - every published example, fixture, or sample document validates against the
   schema it exemplifies, and where a field is optional but load-bearing, the
   examples cover both its presence and its absence rather than leaving one shape
@@ -1120,6 +1129,9 @@ than reviewable; without it the section states an obligation whose satisfaction
 cannot be observed, which is the §9.1 defect this standard has now corrected four
 times. Drafted in `gate-house/docs/contracts/approval-emission-detection.md`,
 which `approval-engine`'s `cadence.yaml` implements as the reference instance.
+The check states no MUST/SHOULD split of its own: which evidence classes must
+declare cadence, and in which form, is the governing profile's to say (§17), and
+this item follows it rather than restating it.
 Raised by `audit-core` as the general form of `GH-IN-0001`, so the finding that
 produced `GH-WP-0002` cannot recur unnoticed.
 
@@ -1288,7 +1300,7 @@ Two things that acceptance does and does not mean, kept apart because
 | --- | --- |
 | **Boundary assent** | given by the four repositories below, at the version named in each record, and undisturbed since |
 | **Revision review** | v0.7's changes were each the adopted remedy of a v0.6 finding. All fifteen v0.6 findings were subsequently audited against the v0.7 body — not against its change log — and confirmed dispositioned (`gate-house/docs/conformance/2026-09-06-v06-findings-audit.md`) |
-| **Not claimed** | no repository has yet reviewed v0.8 *as text*. This version is circulated for that review before acceptance |
+| **Not claimed** | no repository has yet reviewed v0.8 *as text*, apart from `net-kingdom`'s review of §11 and §17 against the profile it owns (2026-09-07: §17 confirmed in its own voice, §11 corrected). This version is circulated for that review before acceptance |
 
 
 **Ten of this version's eleven changes were requested by another repository**,
@@ -1371,7 +1383,15 @@ v0.7 → v0.8:
    `kings-guard` against the line this standard's owner had proposed).
 6. **§11 gains the emission-guarantee declaration**, so a source catalogued as
    evidence declares what its emission actually guarantees rather than
-   reintroducing `GH-IN-0001` silently.
+   reintroducing `GH-IN-0001` silently. The check defers the form to the
+   governing profile instead of restating it: as first cut it required a
+   heartbeat *or* reconciliation of every load-bearing source, which both
+   over- and under-stated
+   `emission-cadence-security-profile_v0.1.md` — it withheld from a volume class
+   the rate monitoring the profile permits, and accepted for a rare class either
+   control alone where the profile requires both. It also contradicted its own
+   following paragraph. Corrected by `net-kingdom` on review of the ownership
+   §17 assigns it (`NK-WP-0035`).
 7. **§11 and §12 gain the derived-artifact rules** — examples validate against
    the schema they exemplify and cover both shapes of an optional load-bearing
    field; derivatives are marked with source and derivation version; dated review

workplans/NK-WP-0035-emission-cadence-security-profile.md

@@ -9,7 +9,7 @@ owner: codex
 topic_slug: netkingdom
 planning_priority: P1
 created: "2026-09-04"
-updated: "2026-09-05"
+updated: "2026-09-07"
 related:
   - GH-DEC-2026-004
   - canon/standards/security-layer-model_v0.7.md
@@ -115,3 +115,34 @@ State Hub reconciliation was attempted with both the installed CLI and current
 checkout. Full reconciliation remains pending because API queries/writes timed
 out or returned connection-refused errors. Generated index/intake metadata was
 reviewed; the source files remain authoritative.
+
+## Review the layer model's use of the profile
+
+```task
+id: NK-WP-0035-T05
+status: done
+priority: high
+```
+
+`gate-house` circulated `security-layer-model_v0.8.md` into this repository with
+two questions for the profile's owner: whether §17's ownership paragraph says
+what NetKingdom would say in its own voice, and whether §11's new
+emission-guarantee conformance item follows the profile or diverges from it.
+
+2026-09-07 review. §17 is confirmed as written: it assigns the generic contract
+to `info-tech-canon` and to this repository the MUST/SHOULD split, the
+rare-class rate-monitoring prohibition, and the heartbeat-plus-reconciliation
+obligation — which is the profile's §3, including the conjunction.
+
+§11 diverged in both directions and was corrected in place. As first cut it
+required a detection surface of *"heartbeat or reconciliation"* of every
+load-bearing source: that withholds from a volume load-bearing class the
+`expected-rate` form the profile permits, and accepts for a rare class either
+control alone where the profile and
+`tools/emission-cadence-profile/emission_cadence_profile.py` require both. It
+also contradicted §11's own following paragraph, which admits rate monitoring
+except where the class is rare. The item now defers the form to the governing
+profile, carries the volume/rare split explicitly, and states that
+classification is the source's to publish and never the checker's to infer.
+Change log item 6 and §14 record the review; the standard remains `proposed` and
+publication waits on the close of the circulation round.