approval-engine/history/2026-08-29-security-layer-model-v0.7-scope-intent-review.md

# Security layer model v0.7 — approval-engine scope vs intent review

**Date:** 2026-08-29
**Statute:** `net-kingdom/canon/standards/security-layer-model_v0.7.md` (accepted)
**Companion:** `net-kingdom/SECURITY-COMPANION.md` v0.2
**Reviewed against:** this repository's v0.5-aligned `INTENT.md` (commits
`0c481de`, `35fee0e`, `ab5d69e`), the empty implementation, and the first-cut
`SCOPE.md` written from the aligned intent
**Outcome:** INTENT aligned to v0.7; SCOPE created as a first-cut boundary;
implementation is seed-only. The work to evolve the repo is
`APPROVAL-WP-0001`.

Hub MCP tools were not exposed in this session. Orientation and the inbox
read used the State Hub HTTP API at `http://127.0.0.1:8000`. The gate-house
broadcast `ACCEPTED: security layer model v0.7 — and start here:
net-kingdom/SECURITY-COMPANION.md` is the trigger.

---

## What v0.5 already had right

The seed INTENT, written against v0.5, already carried the properties that
make this engine an engine:

- the object, not the decision;
- atomic supersession and single consumption;
- local transactional outbox, no synchronous `audit-core` in the mutation
  path;
- claim shape with identifier and canonical-binding digest;
- consumption ordering recorded as unresolved rather than guessed;
- the "what would make this repository wrong" list.

Those survive. v0.7 does not reopen them. It types them, bounds them, and
adds obligations the v0.5 text did not know it owed.

## What v0.6/v0.7 changed that this engine must carry

| Change | Where | Effect on this repo |
| --- | --- | --- |
| Engines are typed. This one is **PIP**. | §3.3, §4 | INTENT frontmatter `layer: Engine` / `role: PIP`. A new engine is a PIP unless the statute is amended; it can never be a second PDP. |
| Machine-readable declaration | §11, companion §2 | `layer.yaml` in this engine's own voice. A layer stated *about* this repo is not a declaration. |
| Statute accepted; companion is the operative form | §14, companion | Cite v0.7 as accepted. Disagreement with the companion is a finding, not a workaround. |
| Threat decomposition on §9.6 | §9.6, v0.7 change 5 | Local outbox **prevents accidental omission**. It does **not** prevent a compromised source. Cadence/reconciliation **detects** the adversarial case after the fact. The residual is stated. |
| Cadence is MUST for load-bearing, and rate monitoring is the wrong form | §9.6 | Revocations are rare. Required form: heartbeat or positive reconciliation against `audit-core` (`GH-WP-0002-T04`). |
| Stronger custody decided: no | §13, §16 | v0.5 INTENT treated this as an open gap this engine must not assume closed. v0.7 closes it: same bound as every other source. Archival custody does not address omission. |
| Time in the model | §9.7 | Every allow has a lifetime (the object's validity window). Consumption is a mutation, never an inference from a decision record. Three races named, each needing an owner. |
| Claim schema includes issuer and freshness | §17, §9.7.2 | The v0.5 claim (id + binding digest) is necessary and not sufficient. PDP deadlines are per input class; this PIP must publish freshness. |
| Approval objects are not Railiance workloads | §20.1 | Do not grow a `rail-*` / `rapp-*` mapping. How the axes meet the model is unwritten. |
| Observation and actuation at zero | companion §10, §9.2, §12 | Do not cite "observed in operation". Do not plan on automatic containment. |
| Evidence outage rule is a trade, not a property | §3.3 | `audit-core` MUST NOT block the recorded operation *by default*. Independent-recording-before-effect remains raisable. This engine's local-outbox rule is how availability and atomicity coexist. |

## Scope vs intent

`INTENT.md` is the kind of system this repository is meant to become.
`SCOPE.md` is the first-cut boundary: what the first workplan is allowed to
build, and what it is forbidden to guess.

There is no contradiction of ownership. Every in-scope item is an INTENT
item. The gaps are maturity, missing contracts, and a missing runtime.

### Intent scorecard

| Intent area | SCOPE | Implementation | Material gap |
| --- | --- | --- | --- |
| PIP, never PDP | In scope as a prohibition | No endpoints exist, so no decision surface exists either | Vacuous. The failure mode is the first endpoint that answers "may". Guard with `layer.yaml` `decision_surfaces_exposed: none` and a test once code exists. |
| Durable object + closed state machine | In scope | None | Entire store and machine. First implementation slice. |
| Atomic supersession and single consumption | In scope as CAS | None | Must be in the first mutation API. Read-then-write is a defect, not a stepping stone. |
| Authenticated entries, distinct-approver counting | In scope | None | Depends on `key-cape` claims for identity; this engine counts and binds, it does not authenticate. |
| Validity window / expiry | In scope | None | The object's lifetime is how §9.7.1 lands here. |
| Revocation without holder cooperation | In scope | None | Load-bearing event. Must hit the local outbox in the same transaction. |
| Claim: id + binding digest | In scope | None | Needed for `FLEX-WP-0017` T05. |
| Claim: issuer + freshness | In scope | None | v0.7 addition. Until Taxonomy's request-claim schema exists, publish a local contract and yield later. |
| Local outbox, no sync `audit-core` in the mutation txn | In scope | None | Prose contract in INTENT; wire contract not written (`GH-WP-0002-T02`). |
| Fail-the-transaction-if-emission-fails test | Success criterion; in scope | None | Demonstrable, not inspectable. |
| Cadence / heartbeat / reconciliation | In scope as declaration + design | None | MUST for load-bearing. `GH-WP-0002-T04` is the detection surface; this engine owes the source side. |
| Consumption ordering | **Explicitly out of first-cut** | Must stay unimplemented | Unresolved in §16 / `GH-WP-0002-T06`. Implementing it is the failure INTENT names. |
| Stronger custody | Out of scope (decided no) | n/a | Closed. Do not reopen in this repo. |
| Policy, identity, archive, maturity, inbox | Out of scope | n/a | Unchanged from v0.5. |
| PEP stance / Railiance axes | Out of scope | n/a | v0.7 clarification. |
| Canon `T-06` | Success criterion | Unrunnable | No implementation to point the test at. |
| `FLEX-WP-0017` T03 / T05 | Success criterion | Blocked | T03 waits on the object; T05 waits on T03 and on consumption ordering. |

### Where SCOPE is narrower than INTENT on purpose

1. **Consumption signaling.** INTENT owns the mutation. SCOPE forbids
   implementing *when* it fires until the other engine assents. This is not
   a missing SCOPE item; it is a named wait.
2. **Shipped capabilities.** INTENT describes a live PIP. SCOPE currently
   provides **none**. Advertising a capability block would claim a surface
   that does not exist.
3. **Taxonomy claim schema.** INTENT will yield to it. SCOPE publishes a
   local contract in the meantime rather than waiting on an unassigned
   owner.

### Where SCOPE would be wrong if it grew

- A "may this actor do X" helper for local tests.
- Storing approvals in the State Hub as a substitute object
  (`FLEX-WP-0017` T03 already rejected that shape).
- Emitting synchronously to `audit-core` "for now" to skip the outbox.
- Inferring consumption from a decision record, because it is easier than
  a mutation.
- A workflow inbox, because operators will ask for one.
- A Railiance mapping, because §20 looks adjacent.

## Implementation necessities

The repository at review time contains documentation and git history. There
is no language runtime, schema, store, or test. Everything in SCOPE is
therefore a necessity, sequenced so that contracts precede code, and so that
the one unowned contract is not filled in from this side.

### P0 — must exist before any mutation API is reachable

1. **Claim contract** — identifier, canonical-binding digest, issuer,
   freshness. `access-engine` cannot consume what is not specified.
2. **Local outbox wire contract** — event classes, at-least-once into the
   outbox, `audit-core` dedupes on event id. Boundary is in INTENT; the
   wire is `GH-WP-0002-T02`.
3. **Keep consumption unimplemented** until `GH-WP-0002-T06`. A reachable
   `consume` that guesses the races is worse than no `consume`.

### P0 — first implementation slice, after the contracts

4. **Durable object and closed state machine** with CAS supersession and
   CAS consumption *once T06 has settled the latter*.
5. **Authenticated entries and distinct-approver counting.**
6. **Introspection API** that returns the claim and never a decision.
7. **Revocation** without holder cooperation, outbox-atomic, effective at
   next use.
8. **Fail-closed on this store's outage; never on `audit-core`'s.** Proven
   by a test that fails the transaction when emission fails, and by a test
   that revokes while the evidence engine is down.

### P1 — load-bearing evidence residual

9. **Heartbeat or reconciliation** for issuance / use / supersession /
   revocation classes. Rate monitoring is not an acceptable substitute.
   Source side of `GH-WP-0002-T04`.
10. **Layer conformance test** once code exists: no decision surface, no
    undeclared Tooling contact, outbox remains local.

### P2 — yield, do not invent forever

11. Replace the local claim contract with Taxonomy's request-claim schema
    when that artifact exists and is assented.
12. Do not cite production observation or automatic containment. Both are
    at zero estate-wide.

## Dependencies this repo does not own

| Work | Owner | What we owe |
| --- | --- | --- |
| `GH-WP-0002-T02` outbox wire | `gate-house` | Satisfy the contract; do not author doctrine |
| `GH-WP-0002-T03` revocation failure mode | `gate-house` | Local-outbox already narrows it; ship the engine to the ruling |
| `GH-WP-0002-T04` detection surface | `gate-house` | Heartbeat / counts from this side |
| `GH-WP-0002-T06` consumption ordering | `gate-house` + `access-engine` | Mutation API after assent, not before |
| `FLEX-WP-0017` T03 / T05 | `access-engine` / `flex-auth` | The object and the claim; not a hub substitute |
| `AUDIT-IN-0001` | `audit-core` | Local outbox, no validity query from records |
| Taxonomy request-claim schema | unassigned | Local contract, then yield |
| Canon `T-06` | `whitehat-security` / canon | A live implementation to aim at |

## Conformance snapshot

| §11 state | Now | Notes |
| --- | --- | --- |
| Layer declared in own voice | yes | INTENT frontmatter + `layer.yaml` |
| Claims inside layer permissions | yes, as prose | Reviewable, not compileable, until there is code |
| Tooling contacts | none | Vacuously conforming. Intended non-Tooling clients listed so they cannot appear as silence. |
| Decision surface | none | Required to stay none |
| Blocked-clean items | none of ours | Consumption wait is an unsettled contract, not a missing engine surface |

## Position

approval-engine assents to v0.7 as the statute it already declared under at
v0.5, typed and bounded. The PIP role is correct. The local-outbox rule is
already in the seed INTENT. The new obligations that bite are the heartbeat
for load-bearing classes, issuer and freshness on the claim, the explicit
ban on inferring consumption, and the custody question being closed rather
than held open.

The implementation gap is total. The dangerous gap is not the missing code;
it is the temptation to fill `GH-WP-0002-T06` from this side so that a
demo `consume` exists. SCOPE forbids that. `APPROVAL-WP-0001` is the work
that remains.