01Purpose
This contract is the first bounded C6 feedback mechanism. It turns explicit posture review dates, evidence freshness, implemented-but-unevidenced controls, and declared gaps into deterministic remediation proposals.
It does not modify a posture level, policy, declaration, workplan, State Hub, or runtime. Human or separately governed automation decides whether a proposal becomes work.
02Deterministic time
Evaluation requires an explicit RFC 3339 as_of timestamp. Wall-clock time is never read implicitly. A date-only review_due remains current through that calendar date in UTC and becomes overdue on the following UTC date.
A non-negative horizon in days identifies items due soon. Changing the horizon changes the report digest and is therefore visible.
03Owner resolution
The evaluator routes only from authoritative declaration fields:
- posture review, gaps, and implemented controls:
responsible_repo; - evidence replacement:
evidence_freshness.<level>.responsible_repo; - security-zone review:
zones.responsible_party.
If the relevant field is absent, owner resolution is unknown. The evaluator must not infer ownership from the service name, repository path, Git remote, previous work, or another policy subject.
04Finding classes
| Finding | Trigger | Severity |
|---|---|---|
posture-review-overdue | as_of is after tenancy.review_due | high |
posture-review-due-soon | review is within the horizon | medium |
zone-review-overdue | as_of is after zones.review_due | high |
zone-review-due-soon | zone review is within the horizon | medium |
evidence-freshness-unknown | a current adversarial level has no complete freshness entry | high |
evidence-expired | as_of is after valid_until | high |
evidence-due-soon | evidence expires within the horizon | medium |
implemented-not-evidenced | an implemented level is above current | medium |
declared-gap | a non-empty tenancy.gap entry exists | low |
The review horizon does not generate a due-soon finding for an item already overdue or expired. Exact equality with a timestamp is still valid; expiry is strictly as_of > valid_until.
Current adversarial levels are E2, R4, and V2–V4. This vocabulary comes from Tenancy Posture §13. Mechanical evidence is evaluated for expiry only when its declaration explicitly supplies valid_until.
05Proposal and safety boundary
Every finding receives a stable id derived from its source declaration, service, finding class, control, and due value. It contains the authoritative owner or unknown, current evidence state, reason, and recommended action. For declarations under the workspace containing this repository, the source is normalized to <repo>/<path> so absolute checkout locations do not perturb the identity. This source normalization identifies an input only; it is never an ownership inference.
Every report declares:
automation: mode: proposal-only external_write_permitted: false policy_mutation_permitted: false declaration_mutation_permitted: false
Expired or unknown evidence does not silently inherit freshness and does not silently downgrade a level. It makes the uncertainty visible for governed review. Consumers that use the report as an admission gate may fail closed on high findings, but that is a separate owner decision.
06Exit behavior
The CLI emits a report conforming to posture-feedback-report_v0.1.schema.json. --fail-on high exits non-zero when at least one high-severity finding exists; medium includes medium and high; low includes every finding; none reports without a finding-based failure. Invalid declarations always exit non-zero.