approval-engine/layer.yaml

# approval-engine — DERIVED form of the NetKingdom security layer declaration
#
# THIS FILE DOES NOT GOVERN. The declaration is the `layer:` key in INTENT.md's
# frontmatter; this file is a derived artifact under §11's derived-artifact rule
# and must agree with it (GH-DEC-2026-017 §1, amendment A11). A disagreement
# between the two forms is a finding in its own right and is reported, never
# resolved away by precedence.
#
# INTENT.md says `Engine`, this file says `engine`. The §3 vocabulary is closed
# (Taxonomy, Tooling, Engine, Staff) and compared after an ASCII case fold
# (GH-DEC-2026-017 §2-§3, A9), so these are the same value. Neither is
# re-spelled; folding case is the checker's job.
#
# Framework: net-kingdom/canon/standards/security-layer-model
# Companion: net-kingdom/SECURITY-COMPANION.md v0.2
# Voice:     INTENT.md (this repository's own, per §11 "who must declare")
#
# Reference form offered by ops-warden and adopted by audit-core and
# kings-guard. Prose cannot distinguish a declaration from a transcribed
# review; this file is the mechanical half.

schema_version: "0.1"
framework: netkingdom-security-layer-model

# §11 derived-artifact marking (GH-DEC-2026-017 §1 / A11).
derived: true
derived_from: INTENT.md

# No `standard_version` key, here or in INTENT.md: GH-DEC-2026-017 §5 / A12 —
# a layer declaration MUST NOT carry a standard version. The declared layer is
# a standing property; version-scoped state belongs in the derived conformance
# record. Do not add it back.
companion_version: "0.2"
repository: approval-engine
layer: engine
role: pip                             # §3.3 engine typing; §4 catalog
declared_by: INTENT.md
declared_at: "2026-08-29"

# §4 catalog entry, transcribed so drift between the catalog and this file
# is visible. The statute is authoritative for the row.
catalog_entry:
  owns:
    - the approval object — durable, authenticated, consumable, atomically supersedable
  statute: "§9.4"

# §3.3: a PIP supplies facts a decision consumes as claims. Outage is input
# degradation, which is this engine's fallback to own (§9.3).
# §6: no repository other than access-engine exposes an authorization decision.
decision_surfaces_exposed: none

# §9.4 — callers needing current state ask this engine. audit-core must not
# expose an approval-validity query; this engine must not expose a decision.
approval_validity_query: owned        # current-state introspection, not a verdict on "may"

# §5 applies to Staff. This is an Engine. Its future transactional store is
# its own operational store, not a §4 Tooling row (same reasoning as
# audit-core's PostgreSQL custody).
tooling_contacts: []

# §11: record non-Tooling clients so the check is total. The SQLite store is
# this engine's own operational store, not a §4 Tooling row. Drain is a
# callback; no audit-core client is compiled in.
non_tooling_clients: []

intended_non_tooling_clients:
  - target: audit-core
    layer: engine
    rationale: "Evidence destination for the local outbox drain. Engine API."
  - target: access-engine
    layer: engine
    rationale: "Consumer of claims. This engine does not call it to decide."
  - target: state-hub
    layer: not-catalogued
    rationale: >-
      Progress events. Outside §5 by the v0.5 scope rule. Recorded, not
      policed, and must not become a state plane another layer reads for
      approval current-state.

# §9.6 — approval evidence is load-bearing. Atomicity prevents accidental
# omission; it does not prevent a compromised source. Cadence for
# low-volume load-bearing classes is reconciliation or a heartbeat.
evidence:
  kind: load-bearing
  atomicity: local-outbox
  cadence_form: heartbeat-or-reconciliation
  cadence_status: declared
  cadence: cadence.yaml
  residual: adversarial-omission-at-compromised-source
  custody: same-bound-as-every-other-source   # §16 decided: no stronger archive

declared_shapes:
  "5.1": []
  "5.2": []
  "5.3": []