net-kingdom/workplans/NK-WP-0035-emission-cadence-security-profile.md

id	type	title	domain	repo	status	flavor	owner	topic_slug	planning_priority	created	updated	related	state_hub_workstream_id
NK-WP-0035	workplan	Publish the NetKingdom emission-cadence security profile	infotech	net-kingdom	active	implementation	codex	netkingdom	P1	2026-09-04	2026-10-23	GH-DEC-2026-004 canon/standards/security-layer-model_v0.7.md	04685f94-1991-5e62-80d2-5669913e99fc

NK-WP-0035 — NetKingdom emission-cadence security profile

GH-DEC-2026-004 assigns the ecosystem-wide EmissionCadenceDeclaration contract to info-tech-canon and the importing NetKingdom security profile to this repository. This work accepts that split. It must not copy the generic schema drafted by kings-guard or make the observer the owner of source classifications.

Define the importing security profile

id: NK-WP-0035-T01
status: done
priority: high
state_hub_task_id: "dc39bd1f-420d-55e9-b4d1-990c39dc251b"

Publish the NetKingdom MUST/SHOULD obligations over the generic contract: load-bearing classes declare cadence, attributive classes should, and rare load-bearing classes use heartbeat plus reconciliation with rate monitoring forbidden. Keep source classification owner-authored and preserve the residual that cadence detects omission only after the fact.

Implemented as proposed canon at canon/standards/emission-cadence-security-profile_v0.1.md. The profile accepts the GH-DEC-2026-004 split, requires source-owned classification, distinguishes MUST from SHOULD coverage, and records that omission detection is after the fact rather than proof of completeness.

Implement mechanical profile validation

id: NK-WP-0035-T02
status: done
priority: high
state_hub_task_id: "0cdfbee7-f5cd-5a43-b27f-752cc72f56f6"

Validate a declaration against an explicitly supplied InfoTechCanon JSON Schema before applying the NetKingdom overlay. The checker must not ship a fallback generic schema, infer evidence class or rarity from event contents, or treat a SHOULD finding as a MUST failure by default.

Implemented at tools/emission-cadence-profile/emission_cadence_profile.py. It requires --contract-schema, performs generic validation first, then checks the NetKingdom overlay against caller-supplied source inventory assertions. No generic fallback schema or owner declaration instance was added here.

Verify the boundary and failure cases

id: NK-WP-0035-T03
status: done
priority: medium
state_hub_task_id: "9cbfaed0-b827-58b3-a79d-2efebb69ed58"

Cover contract-first validation, missing and mismatched class declarations, the allowed high-volume load-bearing rate form, the forbidden rare-event rate form, both positive controls for rare load-bearing classes, duplicate classes, and advisory attributive coverage.

Verification on 2026-09-04: eight focused tests pass; the 81-test root tests/ + tools/ regression suite passes; Ruff lint and format checks pass; Python compilation and git diff --check pass.

Bind and hand off the published contract

id: NK-WP-0035-T04
status: wait
priority: high
blocking_reason: "Elapsed-hour capture done 2026-10-15 (3 events, receiver readback captured). Readback run 2026-10-23: presence 3/3, counts refused 403 source_not_allowed (operator reader scoped to user-engine); audit-core cross-source count path implemented (d46e89e); waiting on the founder's audit-core release (AUDIT-WP-0013-T07) and the rerun, then King's Guard acceptance (KG-WP-0005-T03, wait) and QONTO-WP-0006-T03."
state_hub_task_id: "e3fbc8b8-00d5-57ce-ba0c-19b58044c950"

When info-tech-canon publishes its versioned contract and schema, replace the pending import locator with its canonical coordinates and digest, validate the owner-source instances, and notify kings-guard to replace its draft-shaped fixture. This task cannot be completed from NetKingdom without the upstream artifact and must not be worked around by copying the draft.

2026-09-05 review: the upstream publication blocker is resolved by InfoTechCanon 0.7.0 / contract 0.1.0. Bound the profile to the schema coordinates, revision and SHA-256; fixed the checker to read extensions.netkingdom, removed draft reconciliation aliases, and enforced unique source IDs. Fifteen focused tests pass, including direct integration with the published owner schema and CLI exit-policy coverage.

The current owner instances (approval-engine/cadence.yaml and qonto-assistant/specs/audit-emission-cadence.yaml) were reviewed and checked; both still fail generic contract validation because they use draft envelopes. No source instance was rewritten by NetKingdom. T04 remains wait for each owner's migration and subsequent profile validation, followed by the King's Guard handoff. The profile remains proposed.

Validation: python3 -m pytest tests tools -q passed 106 tests, including 18 privacyIDEA and 15 cadence cases. Ruff lint/format, shell syntax, embedded Python compilation and git diff --check passed.

State Hub reconciliation was attempted with both the installed CLI and current checkout. Full reconciliation remains pending because API queries/writes timed out or returned connection-refused errors. Generated index/intake metadata was reviewed; the source files remain authoritative.

Import metadata reconciled — 2026-09-28

Updated the importing profile to candidate document 0.2.0 / wire schema 0.1, reviewed contract revision 4d0851c3fca306538b53838421f4499baf352778, and owner-published candidate bundle digest b08b4d95fc4b0bd3. Verified the schema SHA-256 remains 6d52692eb1e4d1325e0d6062d95acded98beddaae5bcfe24c6f0e91f1b6be6ae. Corrected local-identity's current declaration pin and preserved the old pin with its correction in the historical findings. No emission behavior changed.

All 15 focused cadence tests pass. Revalidation with the two source-owned rare-class assertions is generic-valid and still returns exactly two rare-heartbeat-missing findings. T04 remains wait for external source migration, observer integration and the explicit local-identity incompatibility resolution; the profile remains proposed. Metadata repair is complete and does not count as source/observer adoption.

Review the layer model's use of the profile

id: NK-WP-0035-T05
status: done
priority: high
state_hub_task_id: "8bcd9d33-0ffc-567e-96a3-b93dcd8059c7"

gate-house circulated security-layer-model_v0.8.md into this repository with two questions for the profile's owner: whether §17's ownership paragraph says what NetKingdom would say in its own voice, and whether §11's new emission-guarantee conformance item follows the profile or diverges from it.

2026-09-07 review. §17 is confirmed as written: it assigns the generic contract to info-tech-canon and to this repository the MUST/SHOULD split, the rare-class rate-monitoring prohibition, and the heartbeat-plus-reconciliation obligation — which is the profile's §3, including the conjunction.

§11 diverged in both directions and was corrected in place. As first cut it required a detection surface of "heartbeat or reconciliation" of every load-bearing source: that withholds from a volume load-bearing class the expected-rate form the profile permits, and accepts for a rare class either control alone where the profile and tools/emission-cadence-profile/emission_cadence_profile.py require both. It also contradicted §11's own following paragraph, which admits rate monitoring except where the class is rare. The item now defers the form to the governing profile, carries the volume/rare split explicitly, and states that classification is the source's to publish and never the checker's to infer. Change log item 6 and §14 record the review; the standard remains proposed and publication waits on the close of the circulation round.

Infrastructure review — 2026-09-28

T04 remains wait, but upstream publication is no longer the blocker. The current generic document is candidate 0.2.0 with wire schema 0.1; InfoTechCanon corrected the candidate bundle digest to b08b4d95fc4b0bd3 (the wire schema was unchanged). Review and update the profile's old draft/document/revision description and local-identity's stale bundle pin against the exact owner artifact before handoff; do not confuse a bundle digest with the schema SHA-256.

Approval Engine and Qonto still carry draft-shaped owner envelopes. In addition, NetKingdom now has its own source declaration at local-identity/emission-cadence.yaml: generic validation passed, but both rare load-bearing entries lack the required heartbeat. The source has no audit-core sender/feed; its findings also record dropped audit I/O errors and no completeness claim. Generic validity is not security-profile conformance or an operating observer result.

Extend T04 acceptance to cover the local source explicitly: either implement and evidence activity-scoped heartbeat/reconciliation with its owners, or retain the documented incompatibility without claiming profile-wide adoption. Resolve the declared heartbeat event class versus audit-core's registered heartbeat_classes mapping, migrate the two external owner instances, and obtain a real source/observer result before the King's Guard handoff. Keep the profile proposed; no weakened rare-class conjunction is approved.

Evidence and cross-plan priorities: estate review.

Implementation follow-up — 2026-10-03

Local audit I/O failures now emit a sanitized warning without interrupting bootstrap operations. All144 local-identity and27 cadence checker tests pass. The source's missing heartbeat/feed remains an explicit incompatibility with no completeness claim; this diagnostic does not close operational adoption. Source-owner declaration migrations and King's Guard namespace integration are delegated. Actual sender mappings and observed delivery/reconciliation/readback remain independently owned. T04 remains wait and plan blocked until these receipts exist; the profile remains proposed. Evidence: cadence adoption implementation.

Source migrations applied and independently revalidated: Approval Engine and Qonto are generic-valid and conformant for their explicit source inventories. Local-identity remains generic-valid with exactly two rare-heartbeat-missing findings. Retained reports: docs/evidence/2026-10-03-cadence-owner-assessments.json. Owner tests pass (Approval Engine169, Qonto90). These source checks remove the envelope migration blocker, while actual operating observer acceptance remains unproved. Existing synthetic native Approval Engine delivery/readback receipts are retained; do not request identical synthetic checks as missing evidence.

2026-10-11: demoted to flavor: residual / backlog by founder-authorized triage — off the critical path (identity → authz → secrets → SecurityCase execution). Tasks are unchanged; promote back when demand or risk appears. See the-custodian history/20261011-netkingdom-security-progress-assessment.md.

Resumed implementation — 2026-10-15

Founder requested this increment after NK-WP-0031. T04 remains wait; source revalidation and the reachable observer repair do not satisfy the operational acceptance gate or promote the proposed profile.

Current source declarations were rechecked against the exact imported schema SHA-256. Approval Engine and Qonto pass their explicit owner inventories; local-identity still fails exactly its two rare-heartbeat obligations, without a completeness claim. All 27 profile tests pass. Reports: 2026-10-15 source assessments.

Found and repaired a real King's Guard observer defect: matching only the shared heartbeat event type let one class's fresh beat mask another class's silence. StreamHeartbeat.covered_event_classes now binds the observation to its vouched-for classes. The Qonto adapter explicitly retains its source mapping; unscoped/malformed coverage cannot manufacture a positive. A regression first reproduced false COMPLETE on the prior code. This is source repair, not a deployed feed or live acceptance. Full King’s Guard validation is 128 passed, with changed-file Ruff checks passing. Owner record: kings-guard/workplans/KG-WP-0005-qonto-source-cadence-admission.md (T02 source validation follow-up; T03 operational gate unchanged).

Two stale requirements are corrected in the concrete owner acceptance plan: Audit Core already implements instance-filtered reconciliation in AUDIT-WP-0013-T04, and its September 15 bearer-revocation receipt proves T1 accepted then refused while the incumbent stayed accepted. Neither is absent; the reviewed receiver release and actual lifecycle/window reconciliation still need their own operational evidence.

Approval Engine's requested 172800-second heartbeat registration receives Audit Core's 1.5 grace, yielding 259200 seconds, not a 48-hour effective alert. Requested source/receiver owner choice before live registration: 115200 seconds plus grace for an effective 48h bound, or the requested 172800 seconds plus grace for an effective 72h bound. No choice or approval is inferred while that question is pending.

Qonto has no implemented runtime collector in the reviewed package, only the historical source capture. Its native admission still requires actual collector/runtime pins and reviewed tenant/class/lag mapping under AUDIT-WP-0013-T05, followed by KG-WP-0005-T03. A source fixture, direct log capture or new Markdown declaration cannot supply this missing implementation. No runtime, registry, credential or bank API operation was performed.

Knowledge: Emergent 0.2.6, digest 8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02; start/evidence source guidance directly reviewed, withheld/orientation-only receipt retained. This supplies no operational authority.

Introduce a configurable ecosystem coordination frame

id: NK-WP-0035-T06
status: done
priority: high
state_hub_task_id: "a6478470-5a9a-5805-b4f7-9ed3e6f01a2f"

Founder direction in this sitting supersedes the binary 48h/72h question: long-term ecosystem coordination uses one configurable base frame, initially f=1h, with waits of 2f and 3f. Decision: 1ac5a70f-082e-4d8f-9ac8-59e4c175da02.

Authoritative config is coordination-engine/config/coordination-frame.json. The coordination-engine API validates it and derives durations / deadlines. NetKingdom's compiler derives source declarations, consumer Python defaults, Approval Engine's deployment heartbeat argument, Qonto's deployment environment setting, and the proposed receiver metadata, retaining the frame digest. Heartbeat is f=3600s; registered wait is 2f=7200s; the receiver's 1.5 grace makes the effective deadline 3f=10800s. The formulas also reproduce the old 24h/48h/72h cadence when f is set to 24h.

This is source-level adoption of the setting, not proof that the deployed processes have changed pace or that every ecosystem timer has adopted it. Runtime release/registry receipts remain T04. Credential and approval validity, worker leases and transport retry timers are separate owner contracts. Configuration and regeneration.

T06 source acceptance: 73 coordination-engine tests passed, one live test skipped; 32 compiler/profile tests; 271 Approval Engine; 91 Qonto; 25 package; 128 King's Guard tests passed. The compiler's --check has no drift. Changing f to 10 minutes or 24 hours in isolated test workspaces rescales source, receiver and observer bindings together. Prepared manifests preserve image, identity, secret, routing and scaling fields apart from the timing values and frame-digest annotations. Frame validation.

The earlier 48h/72h question is resolved by the explicit configurable-frame decision. No further deadline selection is waiting on the founder. T04 still requires receiver registration, missing Qonto collector/admission, and operational lifecycle/observer acceptance. The profile remains proposed; this workplan is now 5/6 source tasks done, with T04's operational gate open.

Approved hourly runtime rollout — 2026-10-15

Founder explicitly approved the prepared timing-only rollout. Cluster UID and resource UID/resourceVersion guards matched the reviewed preflight. Both immutable images, identity/secret references and resource/scaling limits were preserved. No receiver registry, credential or bank API operation was performed.

Approval Engine's online backup passed integrity and isolated owner-engine verification, with an independent mode-0600 local copy retained outside Git. The sole pod was replaced under its OnDelete strategy. New pod 423398d8-9705-4ab5-8b2d-aaa4f590d3a1 is Ready with heartbeat 3600s; schema v5 integrity and approval/entry counts are preserved. Readiness returns 200, anonymous observation is refused with 401, and the new heartbeat drained with zero pending outbox rows. Backup and runtime receipt.

Qonto candidate rapp-qonto-00010 carried the hourly setting while all traffic stayed pinned to rapp-qonto-00009. Startup heartbeat, health, an intentionally denied request (403 without a Qonto call), and same-instance source counts versus direct log capture passed. Candidate was then promoted to 100 percent; the main route passed health and the same denial/count checks. Temporary probe pods were removed. Candidate and promoted runtime.

These are runtime setting and immediate delivery receipts, not an elapsed-hour periodic observation or independent collector acceptance. Qonto retains its existing scale-to-zero setting. Receiver registration of 2f=7200s / effective 3f=10800s is still proposed, not deployed. Actual collector/sender admission, lifecycle reconciliation and independent silence/lag findings remain T04; local-identity's explicit incompatibility remains. Profile stays proposed and the workplan stays 5/6 done.

Receiver registration and operational setup — 2026-10-15

Founder explicitly approved the complete reviewed live packet as platform operator and owner of Audit Core, rapp-qonto and qonto-assistant. Workers implemented the missing durable collector, guarded credential-preserving registry update, exact-path CCR0047 projection and independent capture/readback seams. Source verification: Audit Core 333 passed including PostgreSQL, King's Guard 144 passed, collector/capture package 51 passed, platform custody/readback 20 focused tests passed. All three released images scanned zero HIGH/CRITICAL findings. Source tests do not substitute for native receipts.

Approval Engine is now on scanned source a786b06/image16e5d222…, schema6, with a fresh verified online backup, independent mode0600 copy, isolated migration proof and unchanged 54 approval/47 entry counts. Audit Core is on source5227fb1/imageb479801b…, additive migration0007, after a new completed Barman backup. Initial migration attempts exposed absent migration DNS/database egress after the receiver policy had been narrowed; a dedicated migration-only DNS/platform-pg5432 policy repaired it. Successful r3 migration preceded the receiver replacement; native readiness/cadence/instance support passed.

The first attended command refused an inherited OPENBAO_TOKEN variable before writing a receipt; its session was revoked. A fresh contained login with all three ambient token aliases removed completed successfully. Protected registry CAS advanced 15→16, preserving incumbent credentials and sibling entries. Approval Engine now carries its exact declaration and all four class waits7200s (effective10800s). CCR0047 independently generated the Qonto collector's exact source/tenant writer bearer, delivered via its namespace-restricted ESO lane. Reader path/identity/agent-deny negatives and revocation passed; complete ESO projection and running receiver registry agreed after reload. Warden exit0 confirms session revocation and helper cleanup. Registry/custody receipt.

The scanned collector image82bfd410… is deployed with its own service account, namespace-only pod/log reads, exact Kubernetes API egress, audit-core-only receiver egress and 1Gi durable outbox. It has no bank Secret mount. A real startup heartbeat and denied request were accepted202; duplicate200, wrong-source400, wrong-tenant400, read403 and invalid-bearer401 passed. Source own reconciliation reports heartbeat1/deny1, pending0. Controlled collector replacement preserved original first202 receipts through the same PVC. Admission and restart persistence.

The bounded hourly observation Job started 19:36:07UTC /21:36:07Berlin; expected finish is approximately 20:37UTC /22:37Berlin. Health-only polling keeps this one source instance alive while retaining normal scale-to-zero configuration. Its only finance-route request is intentionally denied before any bank call. Read-only capture monitoring automatically retains exact-instance source JSONL/snapshots, durable collector receipts and observed pod inventory. The requested commit/sync checkpoint retains an immutable pending-state snapshot with 89 actual inventory observations at observation checkpoint. The live monitor continues writing separately; this checkpoint is not acceptance. After elapsed capture, the separately implemented owner readback requires a fresh attended login; King's Guard then verifies accepted counts, sequence, coverage and lag. Approval Engine's four native class beats and actual source outbox coordinates are retained/checked in this acceptance phase. Do not invent an elapsed-hour or three-hour silence result from test timestamps.

T04 stays progress, plan active5/6, profile proposed. Receiver registration and collector implementation are no longer missing. Remaining work is actual elapsed-time capture, independent source/receiver correlation and observer acceptance. Local-identity remains explicitly incompatible, with no completeness claim. Detailed state: owner acceptance plan.

2026-10-23 checkpoint. The bounded hourly observation finished. The read-only monitor (hourly-observation-monitor.json) reports helper exit 0 after 60 attempts at 20:37:22Z. It captured three qonto-assistant events for stream instance b351fa6b… (tenant tenant:friendly:binky, window 19:36:16Z..20:37:23Z), with their receiver event IDs, in hourly-observation-capture/. Its status is captured_pending_independent_receiver. Owner status today: AUDIT-WP-0013-T03..T05 done, KG-WP-0005-T03 wait, QONTO-WP-0006-T03 progress. T04 moves to wait. The next step needs a human: an independent receiver readback under a fresh attended operator OIDC login. King's Guard then compares counts, sequence, coverage and lag. This capture is not acceptance, and the profile stays proposed.

2026-10-23: the readback is now one attended command. The helper tools/emission-cadence-profile/receiver_readback.py (6 synthetic tests) reads the retained capture's receiver_readback request. It asks audit-core /v1/reconciliation (same source, tenant, window and instance) and /v1/events/<id> for each of the three IDs, under the operator's own 0600 token file. It writes a value-safe agree/diverge receipt without payloads or the token. A class-name mapping difference between source and receiver shows up as diverge; it is never hidden. The operator runs it through their own port-forward. The receipt then goes to King's Guard (KG-WP-0005-T03) and qonto-assistant (QONTO-WP-0006-T03).

2026-10-23: the readback was run attended by the founder (fresh KeyCape OIDC/MFA login to OpenBao, role platform-admin, through port-forward; token in a 0600 temp file, deleted afterwards, OpenBao session revoked). Receipt: verdict diverge with one finding, reconciliation returned 403: source_not_allowed. Event presence is 3/3, with source and tenant matching. Counts were not obtained: audit-core /v1/reconciliation admits only an identity's own sources (permits_source), and the operator reader is registered for user-engine. This is an authorization-scope result, not a data mismatch. audit-core's own routing comment ("cross-source counts stay behind may_read") reads the other way, so the question went to audit-core: either permit cross-source counts for a full-scope may_read reader, or name the sanctioned independent counting path. Rerun the same helper once that is answered. The receipt still goes to King's Guard as presence-only evidence. T04 stays wait.

2026-10-28: audit-core answered (audit-core d46e89e, AUDIT-WP-0013-T06 done): a full-scope may_read reader (tenants: ["*"]) may now count another source's window on /v1/reconciliation; cross-source answers carry basis: "independent_reader". The helper records receiver_basis and treats a 200 without that basis as diverge. Next: the founder releases the audit-core image (AUDIT-WP-0013-T07: make image-publish, pin digest, dry run, apply, rollout), checks GET /v1/stats returns 200 under the operator reader token, then reruns the same readback. An agree receipt goes to King's Guard (KG-WP-0005-T03) and qonto-assistant.

Automate staged receiver derivation without sibling mutations

id: NK-WP-0035-T07
status: done
priority: medium
state_hub_task_id: "6eedb1ed-4897-50c6-bdb2-9859dc7df3b1"

Completed source/fixture work 2026-10-19 for CUST-WP-0079-T05. The existing coordination-frame compiler now has a receiver-only mode, and its staged adapter compiles indexed NetKingdom renderer, coordination-engine frame/API and approval-engine cadence inputs in an isolated temporary snapshot. Only the local proposed receiver is written/staged. Dedicated Make targets and the existing shared opt-in pre-commit recipe invoke this path; authored sibling files and unstaged source edits are untouched. Missing/conflicted/nonregular inputs, an unstaged receiver/adapter, changed input snapshots and required alternate-index mutations refuse. The existing guard/scanner remain intact.

Eleven focused tests pass, including partial source staging, namespaced sibling index isolation, receiver edit preservation and alternate-index refusal. The first alternate-index test found that Git's default index query itself honored GIT_INDEX_FILE; corrected the query and retained its regression. This is a refined implementation, not an unchanged execution-success claim.

T06 retains ownership of the full multi-consumer frame compiler. T07 owns only the staged local receiver automation introduced here. T04 retains registry, collector and operational lifecycle/observer acceptance; neither this task nor its tests claim runtime activation or a clean week of fleet commit history. See tools/coordination-frame/README.md for commands and source boundaries.