net-kingdom/workplans/NK-WP-0035-emission-cadence-security-profile.md

id	type	title	domain	repo	status	flavor	owner	topic_slug	planning_priority	created	updated	related	state_hub_workstream_id
NK-WP-0035	workplan	Publish the NetKingdom emission-cadence security profile	infotech	net-kingdom	blocked	implementation	codex	netkingdom	P1	2026-09-04	2026-10-15	GH-DEC-2026-004 canon/standards/security-layer-model_v0.7.md	04685f94-1991-5e62-80d2-5669913e99fc

NK-WP-0035 — NetKingdom emission-cadence security profile

GH-DEC-2026-004 assigns the ecosystem-wide EmissionCadenceDeclaration contract to info-tech-canon and the importing NetKingdom security profile to this repository. This work accepts that split. It must not copy the generic schema drafted by kings-guard or make the observer the owner of source classifications.

Define the importing security profile

id: NK-WP-0035-T01
status: done
priority: high
state_hub_task_id: "dc39bd1f-420d-55e9-b4d1-990c39dc251b"

Publish the NetKingdom MUST/SHOULD obligations over the generic contract: load-bearing classes declare cadence, attributive classes should, and rare load-bearing classes use heartbeat plus reconciliation with rate monitoring forbidden. Keep source classification owner-authored and preserve the residual that cadence detects omission only after the fact.

Implemented as proposed canon at canon/standards/emission-cadence-security-profile_v0.1.md. The profile accepts the GH-DEC-2026-004 split, requires source-owned classification, distinguishes MUST from SHOULD coverage, and records that omission detection is after the fact rather than proof of completeness.

Implement mechanical profile validation

id: NK-WP-0035-T02
status: done
priority: high
state_hub_task_id: "0cdfbee7-f5cd-5a43-b27f-752cc72f56f6"

Validate a declaration against an explicitly supplied InfoTechCanon JSON Schema before applying the NetKingdom overlay. The checker must not ship a fallback generic schema, infer evidence class or rarity from event contents, or treat a SHOULD finding as a MUST failure by default.

Implemented at tools/emission-cadence-profile/emission_cadence_profile.py. It requires --contract-schema, performs generic validation first, then checks the NetKingdom overlay against caller-supplied source inventory assertions. No generic fallback schema or owner declaration instance was added here.

Verify the boundary and failure cases

id: NK-WP-0035-T03
status: done
priority: medium
state_hub_task_id: "9cbfaed0-b827-58b3-a79d-2efebb69ed58"

Cover contract-first validation, missing and mismatched class declarations, the allowed high-volume load-bearing rate form, the forbidden rare-event rate form, both positive controls for rare load-bearing classes, duplicate classes, and advisory attributive coverage.

Verification on 2026-09-04: eight focused tests pass; the 81-test root tests/ + tools/ regression suite passes; Ruff lint and format checks pass; Python compilation and git diff --check pass.

Bind and hand off the published contract

id: NK-WP-0035-T04
status: wait
blocked_on: message-from:approval-engine
blocking_reason: "Founder chose configurable frame f=1h: source heartbeat f, receiver wait 2f, effective deadline 3f. Generated source/runtime bindings await approved deployment and registry admission plus actual lifecycle reconciliation. Qonto still needs an actual rapp-qonto collector and AUDIT-WP-0013-T05 sender admission before KG-WP-0005-T03 observation. Existing bearer-revocation proof is delivered; local-identity incompatibility remains explicit."
priority: high
state_hub_task_id: "e3fbc8b8-00d5-57ce-ba0c-19b58044c950"

When info-tech-canon publishes its versioned contract and schema, replace the pending import locator with its canonical coordinates and digest, validate the owner-source instances, and notify kings-guard to replace its draft-shaped fixture. This task cannot be completed from NetKingdom without the upstream artifact and must not be worked around by copying the draft.

2026-09-05 review: the upstream publication blocker is resolved by InfoTechCanon 0.7.0 / contract 0.1.0. Bound the profile to the schema coordinates, revision and SHA-256; fixed the checker to read extensions.netkingdom, removed draft reconciliation aliases, and enforced unique source IDs. Fifteen focused tests pass, including direct integration with the published owner schema and CLI exit-policy coverage.

The current owner instances (approval-engine/cadence.yaml and qonto-assistant/specs/audit-emission-cadence.yaml) were reviewed and checked; both still fail generic contract validation because they use draft envelopes. No source instance was rewritten by NetKingdom. T04 remains wait for each owner's migration and subsequent profile validation, followed by the King's Guard handoff. The profile remains proposed.

Validation: python3 -m pytest tests tools -q passed 106 tests, including 18 privacyIDEA and 15 cadence cases. Ruff lint/format, shell syntax, embedded Python compilation and git diff --check passed.

State Hub reconciliation was attempted with both the installed CLI and current checkout. Full reconciliation remains pending because API queries/writes timed out or returned connection-refused errors. Generated index/intake metadata was reviewed; the source files remain authoritative.

Import metadata reconciled — 2026-09-28

Updated the importing profile to candidate document 0.2.0 / wire schema 0.1, reviewed contract revision 4d0851c3fca306538b53838421f4499baf352778, and owner-published candidate bundle digest b08b4d95fc4b0bd3. Verified the schema SHA-256 remains 6d52692eb1e4d1325e0d6062d95acded98beddaae5bcfe24c6f0e91f1b6be6ae. Corrected local-identity's current declaration pin and preserved the old pin with its correction in the historical findings. No emission behavior changed.

All 15 focused cadence tests pass. Revalidation with the two source-owned rare-class assertions is generic-valid and still returns exactly two rare-heartbeat-missing findings. T04 remains wait for external source migration, observer integration and the explicit local-identity incompatibility resolution; the profile remains proposed. Metadata repair is complete and does not count as source/observer adoption.

Review the layer model's use of the profile

id: NK-WP-0035-T05
status: done
priority: high
state_hub_task_id: "8bcd9d33-0ffc-567e-96a3-b93dcd8059c7"

gate-house circulated security-layer-model_v0.8.md into this repository with two questions for the profile's owner: whether §17's ownership paragraph says what NetKingdom would say in its own voice, and whether §11's new emission-guarantee conformance item follows the profile or diverges from it.

2026-09-07 review. §17 is confirmed as written: it assigns the generic contract to info-tech-canon and to this repository the MUST/SHOULD split, the rare-class rate-monitoring prohibition, and the heartbeat-plus-reconciliation obligation — which is the profile's §3, including the conjunction.

§11 diverged in both directions and was corrected in place. As first cut it required a detection surface of "heartbeat or reconciliation" of every load-bearing source: that withholds from a volume load-bearing class the expected-rate form the profile permits, and accepts for a rare class either control alone where the profile and tools/emission-cadence-profile/emission_cadence_profile.py require both. It also contradicted §11's own following paragraph, which admits rate monitoring except where the class is rare. The item now defers the form to the governing profile, carries the volume/rare split explicitly, and states that classification is the source's to publish and never the checker's to infer. Change log item 6 and §14 record the review; the standard remains proposed and publication waits on the close of the circulation round.

Infrastructure review — 2026-09-28

T04 remains wait, but upstream publication is no longer the blocker. The current generic document is candidate 0.2.0 with wire schema 0.1; InfoTechCanon corrected the candidate bundle digest to b08b4d95fc4b0bd3 (the wire schema was unchanged). Review and update the profile's old draft/document/revision description and local-identity's stale bundle pin against the exact owner artifact before handoff; do not confuse a bundle digest with the schema SHA-256.

Approval Engine and Qonto still carry draft-shaped owner envelopes. In addition, NetKingdom now has its own source declaration at local-identity/emission-cadence.yaml: generic validation passed, but both rare load-bearing entries lack the required heartbeat. The source has no audit-core sender/feed; its findings also record dropped audit I/O errors and no completeness claim. Generic validity is not security-profile conformance or an operating observer result.

Extend T04 acceptance to cover the local source explicitly: either implement and evidence activity-scoped heartbeat/reconciliation with its owners, or retain the documented incompatibility without claiming profile-wide adoption. Resolve the declared heartbeat event class versus audit-core's registered heartbeat_classes mapping, migrate the two external owner instances, and obtain a real source/observer result before the King's Guard handoff. Keep the profile proposed; no weakened rare-class conjunction is approved.

Evidence and cross-plan priorities: estate review.

Implementation follow-up — 2026-10-03

Local audit I/O failures now emit a sanitized warning without interrupting bootstrap operations. All144 local-identity and27 cadence checker tests pass. The source's missing heartbeat/feed remains an explicit incompatibility with no completeness claim; this diagnostic does not close operational adoption. Source-owner declaration migrations and King's Guard namespace integration are delegated. Actual sender mappings and observed delivery/reconciliation/readback remain independently owned. T04 remains wait and plan blocked until these receipts exist; the profile remains proposed. Evidence: cadence adoption implementation.

Source migrations applied and independently revalidated: Approval Engine and Qonto are generic-valid and conformant for their explicit source inventories. Local-identity remains generic-valid with exactly two rare-heartbeat-missing findings. Retained reports: docs/evidence/2026-10-03-cadence-owner-assessments.json. Owner tests pass (Approval Engine169, Qonto90). These source checks remove the envelope migration blocker, while actual operating observer acceptance remains unproved. Existing synthetic native Approval Engine delivery/readback receipts are retained; do not request identical synthetic checks as missing evidence.

2026-10-11: demoted to flavor: residual / backlog by founder-authorized triage — off the critical path (identity → authz → secrets → SecurityCase execution). Tasks are unchanged; promote back when demand or risk appears. See the-custodian history/20261011-netkingdom-security-progress-assessment.md.

Resumed implementation — 2026-10-15

Founder requested this increment after NK-WP-0031. T04 remains wait; source revalidation and the reachable observer repair do not satisfy the operational acceptance gate or promote the proposed profile.

Current source declarations were rechecked against the exact imported schema SHA-256. Approval Engine and Qonto pass their explicit owner inventories; local-identity still fails exactly its two rare-heartbeat obligations, without a completeness claim. All 27 profile tests pass. Reports: 2026-10-15 source assessments.

Found and repaired a real King's Guard observer defect: matching only the shared heartbeat event type let one class's fresh beat mask another class's silence. StreamHeartbeat.covered_event_classes now binds the observation to its vouched-for classes. The Qonto adapter explicitly retains its source mapping; unscoped/malformed coverage cannot manufacture a positive. A regression first reproduced false COMPLETE on the prior code. This is source repair, not a deployed feed or live acceptance. Full King’s Guard validation is 128 passed, with changed-file Ruff checks passing. Owner record: kings-guard/workplans/KG-WP-0005-qonto-source-cadence-admission.md (T02 source validation follow-up; T03 operational gate unchanged).

Two stale requirements are corrected in the concrete owner acceptance plan: Audit Core already implements instance-filtered reconciliation in AUDIT-WP-0013-T04, and its September 15 bearer-revocation receipt proves T1 accepted then refused while the incumbent stayed accepted. Neither is absent; the reviewed receiver release and actual lifecycle/window reconciliation still need their own operational evidence.

Approval Engine's requested 172800-second heartbeat registration receives Audit Core's 1.5 grace, yielding 259200 seconds, not a 48-hour effective alert. Requested source/receiver owner choice before live registration: 115200 seconds plus grace for an effective 48h bound, or the requested 172800 seconds plus grace for an effective 72h bound. No choice or approval is inferred while that question is pending.

Qonto has no implemented runtime collector in the reviewed package, only the historical source capture. Its native admission still requires actual collector/runtime pins and reviewed tenant/class/lag mapping under AUDIT-WP-0013-T05, followed by KG-WP-0005-T03. A source fixture, direct log capture or new Markdown declaration cannot supply this missing implementation. No runtime, registry, credential or bank API operation was performed.

Knowledge: Emergent 0.2.6, digest 8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02; start/evidence source guidance directly reviewed, withheld/orientation-only receipt retained. This supplies no operational authority.

Introduce a configurable ecosystem coordination frame

id: NK-WP-0035-T06
status: done
priority: high

Founder direction in this sitting supersedes the binary 48h/72h question: long-term ecosystem coordination uses one configurable base frame, initially f=1h, with waits of 2f and 3f. Decision: 1ac5a70f-082e-4d8f-9ac8-59e4c175da02.

Authoritative config is coordination-engine/config/coordination-frame.json. The coordination-engine API validates it and derives durations / deadlines. NetKingdom's compiler derives source declarations, consumer Python defaults, Approval Engine's deployment heartbeat argument, Qonto's deployment environment setting, and the proposed receiver metadata, retaining the frame digest. Heartbeat is f=3600s; registered wait is 2f=7200s; the receiver's 1.5 grace makes the effective deadline 3f=10800s. The formulas also reproduce the old 24h/48h/72h cadence when f is set to 24h.

This is source-level adoption of the setting, not proof that the deployed processes have changed pace or that every ecosystem timer has adopted it. Runtime release/registry receipts remain T04. Credential and approval validity, worker leases and transport retry timers are separate owner contracts. Configuration and regeneration.

T06 source acceptance: 73 coordination-engine tests passed, one live test skipped; 32 compiler/profile tests; 271 Approval Engine; 91 Qonto; 25 package; 128 King's Guard tests passed. The compiler's --check has no drift. Changing f to 10 minutes or 24 hours in isolated test workspaces rescales source, receiver and observer bindings together. Prepared manifests preserve image, identity, secret, routing and scaling fields apart from the timing values and frame-digest annotations. Frame validation.

The earlier 48h/72h question is resolved by the explicit configurable-frame decision. No further deadline selection is waiting on the founder. T04 still requires actual approved rollout/registration, missing Qonto collector/admission, and operational lifecycle/observer acceptance. The profile remains proposed; this workplan is now 5/6 source tasks done, with T04's operational gate open.