From da7747dc4252936eb38b37c6030a5343b120d598 Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 7 Sep 2026 08:44:52 +0200 Subject: [PATCH] =?UTF-8?q?Correct=20v0.8=20=C2=A711:=20the=20emission-gua?= =?UTF-8?q?rantee=20check=20contradicted=20the=20profile=20it=20cites?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit gate-house circulated v0.8 with two questions for this repository as owner of the NetKingdom emission-cadence security profile: whether §17's ownership paragraph reads in our own voice, and whether §11's new conformance item follows the profile or diverges from it. §17 is confirmed as written. It assigns the generic EmissionCadenceDeclaration contract to info-tech-canon and to net-kingdom the MUST/SHOULD split, the rare-class rate-monitoring prohibition, and the heartbeat-plus-reconciliation obligation — which is emission-cadence-security-profile_v0.1.md §3, conjunction included. No change. §11 diverged in both directions and is corrected. Requiring a detection surface of "heartbeat or reconciliation" of every load-bearing source withholds from a volume class the expected-rate form the profile permits, and accepts for a rare class either control alone where the profile — and the checker in tools/emission-cadence-profile — require both. A rare class covered by a heartbeat alone has no reconciliation to catch divergence, and one covered by reconciliation alone produces no claim that can go missing, which is the whole reason §9.6 rejects rate monitoring there. The item also contradicted its own following paragraph, which admits rate monitoring except where the class is rare. The check now defers the form to the governing profile rather than restating a split that is §17's to assign, carries the volume/rare distinction explicitly, and states that classification is the source's published inventory and never the checker's to infer from a name, payload, or observed rate — otherwise omission detection is circular. Change log item 6 and §14 record the review. The standard stays proposed; publication and the acceptance flip wait on the close of the circulation round. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Ek3zTdfMa35bPVDjVUyhxx Assistant: claude-code Assistant-Model: opus Assistant-Process: 868701@bnt-lap001 Assistant-Session: b2e101b6-f501-40dc-9ee5-438cac36e21a --- canon/standards/security-layer-model_v0.8.md | 36 ++++++++++++++----- ...-0035-emission-cadence-security-profile.md | 33 ++++++++++++++++- 2 files changed, 60 insertions(+), 9 deletions(-) diff --git a/canon/standards/security-layer-model_v0.8.md b/canon/standards/security-layer-model_v0.8.md index 5c48b4c..da22557 100644 --- a/canon/standards/security-layer-model_v0.8.md +++ b/canon/standards/security-layer-model_v0.8.md @@ -9,8 +9,8 @@ supersedes: canon/standards/security-layer-model_v0.7.md owner: gate-house publication_owner: net-kingdom created: "2026-08-28" -updated: "2026-09-06" -last_reviewed: "2026-09-06" +updated: "2026-09-07" +last_reviewed: "2026-09-07" review_interval: 3m source_revision: "gate-house@516ed4e" standard_token: security-layer-model_v0.8 @@ -1101,10 +1101,19 @@ Mechanically checkable: a `declared-gap` mark; - every repository catalogued in §4 as a source of evidence declares its **emission guarantee** in its machine-readable layer declaration: for a - **load-bearing** source, a local transactional outbox (§9.4) plus a detection - surface — heartbeat or reconciliation, per §9.6 — and its declared cadence; - for an **attributive** source, the trade it makes and an explicit statement - that completeness is not claimed; + **load-bearing** source, a local transactional outbox (§9.4), its declared + cadence, and the detection surface the governing cadence profile requires for + that class — under `net-kingdom`'s + `emission-cadence-security-profile_v0.1.md`, a **volume** load-bearing class + MAY be covered by rate monitoring where the source has classified it as + suitable, with a positive window and a positive minimum; a **rare** + load-bearing class MUST NOT be, and MUST carry a heartbeat **and** + reconciliation, not either alone; for an **attributive** source, the trade it + makes and an explicit statement that completeness is not claimed. Which class + an event falls in, and whether it is rare, is the source's published + classification: a conformance run is supplied that inventory and MUST NOT + infer it from an event name, payload, or observed rate, or the check becomes + circular; - every published example, fixture, or sample document validates against the schema it exemplifies, and where a field is optional but load-bearing, the examples cover both its presence and its absence rather than leaving one shape @@ -1120,6 +1129,9 @@ than reviewable; without it the section states an obligation whose satisfaction cannot be observed, which is the §9.1 defect this standard has now corrected four times. Drafted in `gate-house/docs/contracts/approval-emission-detection.md`, which `approval-engine`'s `cadence.yaml` implements as the reference instance. +The check states no MUST/SHOULD split of its own: which evidence classes must +declare cadence, and in which form, is the governing profile's to say (§17), and +this item follows it rather than restating it. Raised by `audit-core` as the general form of `GH-IN-0001`, so the finding that produced `GH-WP-0002` cannot recur unnoticed. @@ -1288,7 +1300,7 @@ Two things that acceptance does and does not mean, kept apart because | --- | --- | | **Boundary assent** | given by the four repositories below, at the version named in each record, and undisturbed since | | **Revision review** | v0.7's changes were each the adopted remedy of a v0.6 finding. All fifteen v0.6 findings were subsequently audited against the v0.7 body — not against its change log — and confirmed dispositioned (`gate-house/docs/conformance/2026-09-06-v06-findings-audit.md`) | -| **Not claimed** | no repository has yet reviewed v0.8 *as text*. This version is circulated for that review before acceptance | +| **Not claimed** | no repository has yet reviewed v0.8 *as text*, apart from `net-kingdom`'s review of §11 and §17 against the profile it owns (2026-09-07: §17 confirmed in its own voice, §11 corrected). This version is circulated for that review before acceptance | **Ten of this version's eleven changes were requested by another repository**, @@ -1371,7 +1383,15 @@ v0.7 → v0.8: `kings-guard` against the line this standard's owner had proposed). 6. **§11 gains the emission-guarantee declaration**, so a source catalogued as evidence declares what its emission actually guarantees rather than - reintroducing `GH-IN-0001` silently. + reintroducing `GH-IN-0001` silently. The check defers the form to the + governing profile instead of restating it: as first cut it required a + heartbeat *or* reconciliation of every load-bearing source, which both + over- and under-stated + `emission-cadence-security-profile_v0.1.md` — it withheld from a volume class + the rate monitoring the profile permits, and accepted for a rare class either + control alone where the profile requires both. It also contradicted its own + following paragraph. Corrected by `net-kingdom` on review of the ownership + §17 assigns it (`NK-WP-0035`). 7. **§11 and §12 gain the derived-artifact rules** — examples validate against the schema they exemplify and cover both shapes of an optional load-bearing field; derivatives are marked with source and derivation version; dated review diff --git a/workplans/NK-WP-0035-emission-cadence-security-profile.md b/workplans/NK-WP-0035-emission-cadence-security-profile.md index d6ed11c..7965b14 100644 --- a/workplans/NK-WP-0035-emission-cadence-security-profile.md +++ b/workplans/NK-WP-0035-emission-cadence-security-profile.md @@ -9,7 +9,7 @@ owner: codex topic_slug: netkingdom planning_priority: P1 created: "2026-09-04" -updated: "2026-09-05" +updated: "2026-09-07" related: - GH-DEC-2026-004 - canon/standards/security-layer-model_v0.7.md @@ -115,3 +115,34 @@ State Hub reconciliation was attempted with both the installed CLI and current checkout. Full reconciliation remains pending because API queries/writes timed out or returned connection-refused errors. Generated index/intake metadata was reviewed; the source files remain authoritative. + +## Review the layer model's use of the profile + +```task +id: NK-WP-0035-T05 +status: done +priority: high +``` + +`gate-house` circulated `security-layer-model_v0.8.md` into this repository with +two questions for the profile's owner: whether §17's ownership paragraph says +what NetKingdom would say in its own voice, and whether §11's new +emission-guarantee conformance item follows the profile or diverges from it. + +2026-09-07 review. §17 is confirmed as written: it assigns the generic contract +to `info-tech-canon` and to this repository the MUST/SHOULD split, the +rare-class rate-monitoring prohibition, and the heartbeat-plus-reconciliation +obligation — which is the profile's §3, including the conjunction. + +§11 diverged in both directions and was corrected in place. As first cut it +required a detection surface of *"heartbeat or reconciliation"* of every +load-bearing source: that withholds from a volume load-bearing class the +`expected-rate` form the profile permits, and accepts for a rare class either +control alone where the profile and +`tools/emission-cadence-profile/emission_cadence_profile.py` require both. It +also contradicted §11's own following paragraph, which admits rate monitoring +except where the class is rare. The item now defers the form to the governing +profile, carries the volume/rare split explicitly, and states that +classification is the source's to publish and never the checker's to infer. +Change log item 6 and §14 record the review; the standard remains `proposed` and +publication waits on the close of the circulation round.