Align to Security Layer Model v0.7; revise SCOPE; raise AUDIT-WP-0009

The standard is accepted at v0.7 and all three of audit-core's v0.6
findings landed in it (§9.6 threat decomposition, cadence MUST for
load-bearing sources with reconciliation/heartbeat for low-volume
classes, §3.3's Evidence row restated as an estate trade).

INTENT.md: layer/role declared in frontmatter as §11 and companion §2
require — layer.yaml alone did not discharge it. Layer section rewritten
for the Evidence role and its obligations. New Evidence Bound section
carrying the §9.6 sound/unsound forms and the three-row threat table,
including the residual nothing in the model prevents.

SCOPE.md: replaced the statehub register stub, which carried no boundary
at all. Statute-fixed prohibitions now live here, separated from the
merely-not-yet — §16 ruled the stronger-custody gap closed, so WORM and
data.archive are not ours rather than not yet.

Assessment found nine gaps. Headline: postgres_backend returns
tamper_evidence=True unconditionally while docs/integrity.md permits it
only against a live external attestation, and the one on record is
2026-08-16 with no job renewing it — audit-core overclaiming its own
bound, the §9.6 defect turned inward. Also: no cadence, heartbeat,
reconciliation, or load-bearing classification exists, so the obligation
audit-core argued up from SHOULD to MUST is not yet dischargeable
against audit-core.

AUDIT-WP-0009 raised, ten tasks.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpeL68AWHqtqPQZEXY5kFe

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4040362@bnt-lap001
Assistant-Session: 4fd0fd24-2ee8-4413-bd67-43bd79ca73f1

INTENT.md

@@ -1,3 +1,15 @@
+---
+# NetKingdom Security Layer Model v0.7 (accepted) — §11 / companion §2.
+# Declared by audit-core, in audit-core's own voice. Machine-readable form
+# and the full conformance map: layer.yaml
+layer: Engine
+role: Evidence
+standard: canon/standards/security-layer-model_v0.7.md
+standard_version: "0.7"
+declared_by: intakes/intakes.md AUDIT-IN-0001
+declared_at: "2026-08-29"
+---
+
 # Audit Core Intent
 
 ## Purpose
@@ -19,15 +31,31 @@ on NetKingdom to exist or operate.
 
 ## Layer
 
-Audit Core is **Engine layer** under the NetKingdom security layer model
-(`net-kingdom/canon/standards/security-layer-model_v0.3.md`): it exposes a
-deterministic API contract and holds operational custody of the records it
-accepts.
+Audit Core is **Engine layer, role Evidence** under the NetKingdom Security
+Layer Model v0.7 (`net-kingdom/canon/standards/security-layer-model_v0.7.md`,
+accepted; working form `net-kingdom/SECURITY-COMPANION.md`). It exposes a
+deterministic API contract over a modeled concept — the audit event — and holds
+operational custody of what it accepts. Same authoritative input, same result.
 
-It is explicitly **not a decision point**. Audit Core answers what was recorded;
-it never answers whether an action is permitted, and it exposes no surface that
-returns such a verdict. See `## Out Of Scope Initially` and
-`history/2026-08-28-approval-evidence-assent.md`.
+**Evidence is a role, and it carries obligations the other engine roles do not:**
+
+- Audit Core is explicitly **not a decision point** (§6). It answers what was
+  recorded; it never answers whether an action is permitted, and exposes no
+  surface returning such a verdict.
+- An Audit Core outage **must not block the operation being recorded** (§3.3).
+  v0.7 states this as a deliberate estate trade — availability of the recorded
+  operation over independence of its recorder — not as a property of evidence
+  engines. The consequence is accepted knowingly: a compromised source can
+  suppress, and detection rather than prevention is the answer (§9.6).
+  An operation whose control requirement is *independent recording before
+  effect* remains raisable as a declared exception; the estate has not needed
+  one, and Audit Core would want it raised rather than assumed.
+- What Audit Core may **never claim** is fixed by §9.6 and restated in
+  `## Evidence Bound` below.
+
+Machine-readable declaration and the conformance map: `layer.yaml`.
+Reviews: `history/2026-08-28-approval-evidence-assent.md`,
+`history/2026-08-29-security-layer-model-v0.6-review.md`.
 
 ## Problem
 
@@ -242,6 +270,54 @@ NetKingdom must not be required for Audit Core's internal authorization model.
 Audit Core may accept NetKingdom OIDC claims when configured, but should also
 support a generic OIDC provider and local development auth mode.
 
+## Evidence Bound
+
+Security Layer Model v0.7 §9.6 fixes what Audit Core may claim, and the bound is
+narrower than principle 6 aspires to. `docs/integrity.md` is authoritative on the
+delivered guarantee; this section states the doctrine it must never exceed.
+
+**Sound:** *the archive proves the records it holds were not altered or truncated
+after arrival.*
+
+**Unsound, and Audit Core must never say or imply either:**
+
+- *"the audit record proves it happened"* — the archive proves nothing about an
+  event that was never sent;
+- *"there is no record, so it did not happen"* — absence of a record is not
+  evidence of non-occurrence, and no control may read it as such.
+
+Which control covers which threat:
+
+| Threat | Covered by | When |
+| --- | --- | --- |
+| Accidental omission — process dies between mutation and emit | atomic emission via a **local** outbox at the source (§9.4) | prevented |
+| Adversarial omission — a compromised source declines to insert, deletes before drain, or drains to nowhere | cadence and reconciliation | detected, after the fact |
+| Adversarial omission at a compromised source | — | **nothing in the model prevents it** |
+
+That third row is a known, accepted residual. Audit Core raised it against a
+remedy it had itself proposed, and states it here so no consumer plans around a
+guarantee that does not exist.
+
+**Load-bearing versus attributive.** Where a control's soundness depends on an
+event being present or absent — a revocation, a denial, a containment action —
+the evidence is **load-bearing**: emission MUST be atomic with the state change
+at the source, and the source **MUST** declare an expected emission cadence.
+Otherwise it is **attributive**: atomicity SHOULD be sought, and where it is
+deliberately traded away the trade MUST be declared and completeness MUST NOT be
+claimed.
+
+**Rate monitoring is the wrong form for rare events**, which is exactly where the
+stakes are highest — the most valuable event to suppress is the negative one, and
+revocations and denials are infrequent by nature. For **low-volume load-bearing
+classes** the required form is **positive reconciliation or a heartbeat**:
+compare the source's own state transitions against Audit Core's event count per
+class, or assert *nothing to report* as a signed positive claim that can itself
+go missing. Rate monitoring never produces a claim that can be missing.
+
+Supporting these obligations is Audit Core's work, not only its senders' — a
+source cannot declare a cadence to a system that has nowhere to put it. See
+`workplans/AUDIT-WP-0009-evidence-role-conformance.md`.
+
 ## Approval Evidence
 
 Audit Core carries the **evidence half** of approvals as a distinct source, per