net-kingdom/workplans/NK-WP-0031-deterministic-posture-feedback.md

id	type	title	domain	repo	status	flavor	owner	topic_slug	planning_priority	created	updated	state_hub_workstream_id
NK-WP-0031	workplan	Implement deterministic posture and evidence feedback	infotech	net-kingdom	finished	residual	codex	netkingdom	P1	2026-08-23	2026-10-15	9d7b04f9-3803-5613-b7a5-8bd606c77f5a

NK-WP-0031 — Deterministic posture and evidence feedback

Authorized by the operator as the next locally owned increment after NK-WP-0030. This implements the safe first C6 loop proposed by the 2026-08-23 scope-to-intent assessment: surface explicit drift as proposals without autonomous policy or work-record mutation.

Define freshness, owner, and proposal semantics

id: NK-WP-0031-T01
status: done
priority: high
state_hub_task_id: "917f8856-091e-59f9-b9e4-71a8c9a0d029"

Extend Tenancy Posture declarations with optional authoritative repository and evidence-freshness metadata. Define deterministic time, owner resolution, finding severity, stable identity, and the proposal-only safety boundary.

Implemented in Tenancy Posture draft-14, Posture Feedback v0.1, and their schemas. Missing authoritative ownership or freshness resolves to unknown; source-path normalization never becomes owner inference.

Implement the posture feedback evaluator

id: NK-WP-0031-T02
status: done
priority: high
state_hub_task_id: "63486c21-2ca2-5930-bc27-f8acde3eec8f"

Validate declarations and emit deterministic JSON findings for overdue/due-soon reviews, unknown/expired/due-soon evidence, implemented-but-unevidenced levels, and declared gaps. Require explicit --as-of; never perform external writes.

Implemented under tools/posture-feedback/. The emitted report declares that external, policy, and declaration writes are all forbidden.

Publish reference workflow and tests

id: NK-WP-0031-T03
status: done
priority: high
state_hub_task_id: "0372c168-b34d-5ad5-8315-be3af74758de"

Provide an example declaration and cover freshness boundaries, missing owners, multi-service inputs, stable digests, severity exit thresholds, and invalid declarations.

The checked-in expired-E2 example yields five deterministic proposals at its fixed evaluation time. Focused coverage includes every listed boundary plus portable source identity.

Obtain audit-core freshness adoption

id: NK-WP-0031-T04
status: done
priority: high
state_hub_task_id: "7d2029d2-db8d-526e-ab73-a0751becb193"

Ask audit-core to add authoritative owner and E2 freshness metadata for WH-ENG-20260822-AUDIT-E2-03. The evaluator must report its freshness as unknown until the source declaration supplies the exact timestamps and replacement action; NetKingdom must not parse them from prose.

Requested in State Hub message 874e5fa5-e05c-4b1a-a915-26c4dba07b87. The same estate baseline found pre-existing missing evidence entries for railiance-platform apps-pg current R2 and V1; that separate correction was routed in d65f8383-bdab-488e-a36f-f8cabd8a5f65.

Verify and reconcile

id: NK-WP-0031-T05
status: done
priority: medium
state_hub_task_id: "b646e6a0-20ba-5377-a3d1-7ae92eb9e936"

Run focused and repository regression tests, validate schemas and examples, reconcile State Hub, and publish the implementation evidence.

Verification on 2026-08-23:

• 28 focused posture-feedback and tenancy-validator tests passed;
• 84 root tests passed with the independently packaged local-identity project excluded, then all 142 local-identity tests passed in its own environment;
• both JSON schemas parsed, the fixed-time reference target succeeded, and git diff --check passed;
• reuse-surface validated the capability registry entry; and
• the read-only seven-declaration baseline is recorded in history/2026-08-23-posture-feedback-estate-baseline.md.

Local implementation was complete on 2026-08-23. T04 adoption completed 2026-10-15; see the closure evidence below.

Infrastructure review — 2026-09-28

audit-core/tenancy.yaml still lacks machine-readable authoritative owner and E2 freshness metadata. Its E2 prose retains the August 22 receipt and 24-hour replacement deadline; report freshness as unknown until the required fields exist, without renewing that evidence from prose. The September 24 receiver/database recreate evidence supports V1 only and cannot refresh E2. T04 remains wait; request the source declaration update and evaluate it with an explicit current --as-of before closure.

The same declaration still describes flex-auth as unauthenticated A0, whereas today all six live flex-auth Deployments pass --caller-auth-mode enforce. The audit-core owner should reconcile that rationale against actual caller bindings and policy evidence; deployment flags alone do not prove a new A level.

Evidence and cross-plan priorities: estate review.

2026-10-11: demoted to flavor: residual / backlog by founder-authorized triage — off the critical path (identity → authz → secrets → SecurityCase execution). Tasks are unchanged; promote back when demand or risk appears. See the-custodian history/20261011-netkingdom-security-progress-assessment.md.

Adoption and closure — 2026-10-15

Founder resumed this workplan after the October 11 triage. All five tasks are now done. Audit-core's authoritative tenancy.yaml publishes its responsible repository plus evidence_freshness.E2 with observation, original expiry, bounded scope, target image digest and replacement action. Source adoption is recorded in audit-core/workplans/ADHOC-2026-10-15.md.

The observation and expiry come from the existing August 22 target receipt and declaration: 2026-08-22T22:10:25Z and 2026-08-23T22:10:25Z. No evidence was renewed from prose or September recovery exercises. The posture levels, review dates and evidence references are unchanged.

At explicit --as-of 2026-10-15T17:27:15Z, the evaluator changes E2 from unknown freshness/owner to expired, owned by audit-core, with the exact declared replacement action. The existing overdue posture review also routes to audit-core. All ten findings now have an explicit owner; two high findings and eight declared gaps remain visible. --fail-on high returns 1 as intended; proposal-only reporting does not mutate declarations or policy.

Verification: 28 focused tests passed, source schema/semantic validation passed, repeated current-time reports were byte-identical, and source comparison proves that only the new owner/freshness fields changed. Receipt and report digests are recorded in the adoption evidence, with before and after reports.

Fresh E2 production is not part of this completed adoption increment. The existing live owner work record AUDIT-WP-0015-T02 remains waiting for identity/engagement prerequisites and a separately approved new run. It is not closed or authorized by these metadata changes. No live packets, secret access, runtime changes or posture-level changes occurred.

Security orientation: Emergent Knowledge 0.2.6, package digest 8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02. start and evidence were withheld/orientation-only because sources changed; source cards, current repository instructions, security companion and original owner evidence were reviewed directly. These receipts confer no live authority.