## 01Purpose

This contract is the first bounded C6 feedback mechanism. It turns explicit posture review dates, evidence freshness, implemented-but-unevidenced controls, and declared gaps into deterministic remediation proposals.

It does not modify a posture level, policy, declaration, workplan, State Hub, or runtime. Human or separately governed automation decides whether a proposal becomes work.

## 02Deterministic time

Evaluation requires an explicit RFC 3339 `as_of` timestamp. Wall-clock time is never read implicitly. A date-only `review_due` remains current through that calendar date in UTC and becomes overdue on the following UTC date.

A non-negative horizon in days identifies items due soon. Changing the horizon changes the report digest and is therefore visible.

## 03Owner resolution

The evaluator routes only from authoritative declaration fields:

- posture review, gaps, and implemented controls: `responsible_repo`;
- evidence replacement: `evidence_freshness.<level>.responsible_repo`;
- security-zone review: `zones.responsible_party`.

If the relevant field is absent, owner resolution is `unknown`. The evaluator must not infer ownership from the service name, repository path, Git remote, previous work, or another policy subject.

## 04Finding classes

Finding | Trigger | Severity
--- | --- | ---
`posture-review-overdue` | `as_of` is after `tenancy.review_due` | high
`posture-review-due-soon` | review is within the horizon | medium
`zone-review-overdue` | `as_of` is after `zones.review_due` | high
`zone-review-due-soon` | zone review is within the horizon | medium
`evidence-freshness-unknown` | a current adversarial level has no complete freshness entry | high
`evidence-expired` | `as_of` is after `valid_until` | high
`evidence-due-soon` | evidence expires within the horizon | medium
`implemented-not-evidenced` | an `implemented` level is above `current` | medium
`declared-gap` | a non-empty `tenancy.gap` entry exists | low

The review horizon does not generate a due-soon finding for an item already overdue or expired. Exact equality with a timestamp is still valid; expiry is strictly `as_of > valid_until`.

Current adversarial levels are `E2`, `R4`, and `V2`–`V4`. This vocabulary comes from Tenancy Posture §13. Mechanical evidence is evaluated for expiry only when its declaration explicitly supplies `valid_until`.

## 05Proposal and safety boundary

Every finding receives a stable id derived from its source declaration, service, finding class, control, and due value. It contains the authoritative owner or `unknown`, current evidence state, reason, and recommended action. For declarations under the workspace containing this repository, the source is normalized to `<repo>/<path>` so absolute checkout locations do not perturb the identity. This source normalization identifies an input only; it is never an ownership inference.

Every report declares:

    automation:
      mode: proposal-only
      external_write_permitted: false
      policy_mutation_permitted: false
      declaration_mutation_permitted: false

Expired or unknown evidence does not silently inherit freshness and does not silently downgrade a level. It makes the uncertainty visible for governed review. Consumers that use the report as an admission gate may fail closed on high findings, but that is a separate owner decision.

## 06Exit behavior

The CLI emits a report conforming to `posture-feedback-report_v0.1.schema.json`. `--fail-on high` exits non-zero when at least one high-severity finding exists; `medium` includes medium and high; `low` includes every finding; `none` reports without a finding-based failure. Invalid declarations always exit non-zero.