diff --git a/canon/standards/security-layer-model_v0.8.md b/canon/standards/security-layer-model_v0.8.md index 5c48b4c..da22557 100644 --- a/canon/standards/security-layer-model_v0.8.md +++ b/canon/standards/security-layer-model_v0.8.md @@ -9,8 +9,8 @@ supersedes: canon/standards/security-layer-model_v0.7.md owner: gate-house publication_owner: net-kingdom created: "2026-08-28" -updated: "2026-09-06" -last_reviewed: "2026-09-06" +updated: "2026-09-07" +last_reviewed: "2026-09-07" review_interval: 3m source_revision: "gate-house@516ed4e" standard_token: security-layer-model_v0.8 @@ -1101,10 +1101,19 @@ Mechanically checkable: a `declared-gap` mark; - every repository catalogued in §4 as a source of evidence declares its **emission guarantee** in its machine-readable layer declaration: for a - **load-bearing** source, a local transactional outbox (§9.4) plus a detection - surface — heartbeat or reconciliation, per §9.6 — and its declared cadence; - for an **attributive** source, the trade it makes and an explicit statement - that completeness is not claimed; + **load-bearing** source, a local transactional outbox (§9.4), its declared + cadence, and the detection surface the governing cadence profile requires for + that class — under `net-kingdom`'s + `emission-cadence-security-profile_v0.1.md`, a **volume** load-bearing class + MAY be covered by rate monitoring where the source has classified it as + suitable, with a positive window and a positive minimum; a **rare** + load-bearing class MUST NOT be, and MUST carry a heartbeat **and** + reconciliation, not either alone; for an **attributive** source, the trade it + makes and an explicit statement that completeness is not claimed. Which class + an event falls in, and whether it is rare, is the source's published + classification: a conformance run is supplied that inventory and MUST NOT + infer it from an event name, payload, or observed rate, or the check becomes + circular; - every published example, fixture, or sample document validates against the schema it exemplifies, and where a field is optional but load-bearing, the examples cover both its presence and its absence rather than leaving one shape @@ -1120,6 +1129,9 @@ than reviewable; without it the section states an obligation whose satisfaction cannot be observed, which is the §9.1 defect this standard has now corrected four times. Drafted in `gate-house/docs/contracts/approval-emission-detection.md`, which `approval-engine`'s `cadence.yaml` implements as the reference instance. +The check states no MUST/SHOULD split of its own: which evidence classes must +declare cadence, and in which form, is the governing profile's to say (§17), and +this item follows it rather than restating it. Raised by `audit-core` as the general form of `GH-IN-0001`, so the finding that produced `GH-WP-0002` cannot recur unnoticed. @@ -1288,7 +1300,7 @@ Two things that acceptance does and does not mean, kept apart because | --- | --- | | **Boundary assent** | given by the four repositories below, at the version named in each record, and undisturbed since | | **Revision review** | v0.7's changes were each the adopted remedy of a v0.6 finding. All fifteen v0.6 findings were subsequently audited against the v0.7 body — not against its change log — and confirmed dispositioned (`gate-house/docs/conformance/2026-09-06-v06-findings-audit.md`) | -| **Not claimed** | no repository has yet reviewed v0.8 *as text*. This version is circulated for that review before acceptance | +| **Not claimed** | no repository has yet reviewed v0.8 *as text*, apart from `net-kingdom`'s review of §11 and §17 against the profile it owns (2026-09-07: §17 confirmed in its own voice, §11 corrected). This version is circulated for that review before acceptance | **Ten of this version's eleven changes were requested by another repository**, @@ -1371,7 +1383,15 @@ v0.7 → v0.8: `kings-guard` against the line this standard's owner had proposed). 6. **§11 gains the emission-guarantee declaration**, so a source catalogued as evidence declares what its emission actually guarantees rather than - reintroducing `GH-IN-0001` silently. + reintroducing `GH-IN-0001` silently. The check defers the form to the + governing profile instead of restating it: as first cut it required a + heartbeat *or* reconciliation of every load-bearing source, which both + over- and under-stated + `emission-cadence-security-profile_v0.1.md` — it withheld from a volume class + the rate monitoring the profile permits, and accepted for a rare class either + control alone where the profile requires both. It also contradicted its own + following paragraph. Corrected by `net-kingdom` on review of the ownership + §17 assigns it (`NK-WP-0035`). 7. **§11 and §12 gain the derived-artifact rules** — examples validate against the schema they exemplify and cover both shapes of an optional load-bearing field; derivatives are marked with source and derivation version; dated review diff --git a/workplans/NK-WP-0035-emission-cadence-security-profile.md b/workplans/NK-WP-0035-emission-cadence-security-profile.md index d6ed11c..7965b14 100644 --- a/workplans/NK-WP-0035-emission-cadence-security-profile.md +++ b/workplans/NK-WP-0035-emission-cadence-security-profile.md @@ -9,7 +9,7 @@ owner: codex topic_slug: netkingdom planning_priority: P1 created: "2026-09-04" -updated: "2026-09-05" +updated: "2026-09-07" related: - GH-DEC-2026-004 - canon/standards/security-layer-model_v0.7.md @@ -115,3 +115,34 @@ State Hub reconciliation was attempted with both the installed CLI and current checkout. Full reconciliation remains pending because API queries/writes timed out or returned connection-refused errors. Generated index/intake metadata was reviewed; the source files remain authoritative. + +## Review the layer model's use of the profile + +```task +id: NK-WP-0035-T05 +status: done +priority: high +``` + +`gate-house` circulated `security-layer-model_v0.8.md` into this repository with +two questions for the profile's owner: whether §17's ownership paragraph says +what NetKingdom would say in its own voice, and whether §11's new +emission-guarantee conformance item follows the profile or diverges from it. + +2026-09-07 review. §17 is confirmed as written: it assigns the generic contract +to `info-tech-canon` and to this repository the MUST/SHOULD split, the +rare-class rate-monitoring prohibition, and the heartbeat-plus-reconciliation +obligation — which is the profile's §3, including the conjunction. + +§11 diverged in both directions and was corrected in place. As first cut it +required a detection surface of *"heartbeat or reconciliation"* of every +load-bearing source: that withholds from a volume load-bearing class the +`expected-rate` form the profile permits, and accepts for a rare class either +control alone where the profile and +`tools/emission-cadence-profile/emission_cadence_profile.py` require both. It +also contradicted §11's own following paragraph, which admits rate monitoring +except where the class is rare. The item now defers the form to the governing +profile, carries the volume/rare split explicitly, and states that +classification is the source's to publish and never the checker's to infer. +Change log item 6 and §14 record the review; the standard remains `proposed` and +publication waits on the close of the circulation round.