net-kingdom/workplans/NK-WP-0035-emission-cadence-security-profile.md

id	type	title	domain	repo	status	owner	topic_slug	planning_priority	created	updated	related	state_hub_workstream_id
NK-WP-0035	workplan	Publish the NetKingdom emission-cadence security profile	infotech	net-kingdom	blocked	codex	netkingdom	P1	2026-09-04	2026-09-07	GH-DEC-2026-004 canon/standards/security-layer-model_v0.7.md	04685f94-1991-5e62-80d2-5669913e99fc

NK-WP-0035 — NetKingdom emission-cadence security profile

GH-DEC-2026-004 assigns the ecosystem-wide EmissionCadenceDeclaration contract to info-tech-canon and the importing NetKingdom security profile to this repository. This work accepts that split. It must not copy the generic schema drafted by kings-guard or make the observer the owner of source classifications.

Define the importing security profile

id: NK-WP-0035-T01
status: done
priority: high
state_hub_task_id: "dc39bd1f-420d-55e9-b4d1-990c39dc251b"

Publish the NetKingdom MUST/SHOULD obligations over the generic contract: load-bearing classes declare cadence, attributive classes should, and rare load-bearing classes use heartbeat plus reconciliation with rate monitoring forbidden. Keep source classification owner-authored and preserve the residual that cadence detects omission only after the fact.

Implemented as proposed canon at canon/standards/emission-cadence-security-profile_v0.1.md. The profile accepts the GH-DEC-2026-004 split, requires source-owned classification, distinguishes MUST from SHOULD coverage, and records that omission detection is after the fact rather than proof of completeness.

Implement mechanical profile validation

id: NK-WP-0035-T02
status: done
priority: high
state_hub_task_id: "0cdfbee7-f5cd-5a43-b27f-752cc72f56f6"

Validate a declaration against an explicitly supplied InfoTechCanon JSON Schema before applying the NetKingdom overlay. The checker must not ship a fallback generic schema, infer evidence class or rarity from event contents, or treat a SHOULD finding as a MUST failure by default.

Implemented at tools/emission-cadence-profile/emission_cadence_profile.py. It requires --contract-schema, performs generic validation first, then checks the NetKingdom overlay against caller-supplied source inventory assertions. No generic fallback schema or owner declaration instance was added here.

Verify the boundary and failure cases

id: NK-WP-0035-T03
status: done
priority: medium
state_hub_task_id: "9cbfaed0-b827-58b3-a79d-2efebb69ed58"

Cover contract-first validation, missing and mismatched class declarations, the allowed high-volume load-bearing rate form, the forbidden rare-event rate form, both positive controls for rare load-bearing classes, duplicate classes, and advisory attributive coverage.

Verification on 2026-09-04: eight focused tests pass; the 81-test root tests/ + tools/ regression suite passes; Ruff lint and format checks pass; Python compilation and git diff --check pass.

Bind and hand off the published contract

id: NK-WP-0035-T04
status: wait
priority: high
state_hub_task_id: "e3fbc8b8-00d5-57ce-ba0c-19b58044c950"

When info-tech-canon publishes its versioned contract and schema, replace the pending import locator with its canonical coordinates and digest, validate the owner-source instances, and notify kings-guard to replace its draft-shaped fixture. This task cannot be completed from NetKingdom without the upstream artifact and must not be worked around by copying the draft.

2026-09-05 review: the upstream publication blocker is resolved by InfoTechCanon 0.7.0 / contract 0.1.0. Bound the profile to the schema coordinates, revision and SHA-256; fixed the checker to read extensions.netkingdom, removed draft reconciliation aliases, and enforced unique source IDs. Fifteen focused tests pass, including direct integration with the published owner schema and CLI exit-policy coverage.

The current owner instances (approval-engine/cadence.yaml and qonto-assistant/specs/audit-emission-cadence.yaml) were reviewed and checked; both still fail generic contract validation because they use draft envelopes. No source instance was rewritten by NetKingdom. T04 remains wait for each owner's migration and subsequent profile validation, followed by the King's Guard handoff. The profile remains proposed.

Validation: python3 -m pytest tests tools -q passed 106 tests, including 18 privacyIDEA and 15 cadence cases. Ruff lint/format, shell syntax, embedded Python compilation and git diff --check passed.

State Hub reconciliation was attempted with both the installed CLI and current checkout. Full reconciliation remains pending because API queries/writes timed out or returned connection-refused errors. Generated index/intake metadata was reviewed; the source files remain authoritative.

Review the layer model's use of the profile

id: NK-WP-0035-T05
status: done
priority: high
state_hub_task_id: "8bcd9d33-0ffc-567e-96a3-b93dcd8059c7"

gate-house circulated security-layer-model_v0.8.md into this repository with two questions for the profile's owner: whether §17's ownership paragraph says what NetKingdom would say in its own voice, and whether §11's new emission-guarantee conformance item follows the profile or diverges from it.

2026-09-07 review. §17 is confirmed as written: it assigns the generic contract to info-tech-canon and to this repository the MUST/SHOULD split, the rare-class rate-monitoring prohibition, and the heartbeat-plus-reconciliation obligation — which is the profile's §3, including the conjunction.

§11 diverged in both directions and was corrected in place. As first cut it required a detection surface of "heartbeat or reconciliation" of every load-bearing source: that withholds from a volume load-bearing class the expected-rate form the profile permits, and accepts for a rare class either control alone where the profile and tools/emission-cadence-profile/emission_cadence_profile.py require both. It also contradicted §11's own following paragraph, which admits rate monitoring except where the class is rare. The item now defers the form to the governing profile, carries the volume/rare split explicitly, and states that classification is the source's to publish and never the checker's to infer. Change log item 6 and §14 record the review; the standard remains proposed and publication waits on the close of the circulation round.