Align to Security Layer Model v0.7; revise SCOPE; raise AUDIT-WP-0009

The standard is accepted at v0.7 and all three of audit-core's v0.6
findings landed in it (§9.6 threat decomposition, cadence MUST for
load-bearing sources with reconciliation/heartbeat for low-volume
classes, §3.3's Evidence row restated as an estate trade).

INTENT.md: layer/role declared in frontmatter as §11 and companion §2
require — layer.yaml alone did not discharge it. Layer section rewritten
for the Evidence role and its obligations. New Evidence Bound section
carrying the §9.6 sound/unsound forms and the three-row threat table,
including the residual nothing in the model prevents.

SCOPE.md: replaced the statehub register stub, which carried no boundary
at all. Statute-fixed prohibitions now live here, separated from the
merely-not-yet — §16 ruled the stronger-custody gap closed, so WORM and
data.archive are not ours rather than not yet.

Assessment found nine gaps. Headline: postgres_backend returns
tamper_evidence=True unconditionally while docs/integrity.md permits it
only against a live external attestation, and the one on record is
2026-08-16 with no job renewing it — audit-core overclaiming its own
bound, the §9.6 defect turned inward. Also: no cadence, heartbeat,
reconciliation, or load-bearing classification exists, so the obligation
audit-core argued up from SHOULD to MUST is not yet dischargeable
against audit-core.

AUDIT-WP-0009 raised, ten tasks.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpeL68AWHqtqPQZEXY5kFe

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4040362@bnt-lap001
Assistant-Session: 4fd0fd24-2ee8-4413-bd67-43bd79ca73f1

SCOPE.md

@@ -1,50 +1,115 @@
 # SCOPE
 
-> This file was generated by `statehub register`. Refine it as the repository
-> boundaries become clearer.
+Boundary contract for `audit-core`, aligned to NetKingdom Security Layer Model
+v0.7 (accepted) and its working companion. `INTENT.md` says what Audit Core is
+for; this file says what it does and does not do, and is the file to check
+before adding a surface.
 
 ## One-liner
 
-Reliable multi-tenant auto setup audit capability.
+The estate's Evidence engine: durable, tenant-aware custody of audit events,
+with an honest and bounded integrity claim.
 
-## Core Idea
+## Layer and role
 
-audit-core exists to provide the capability described in INTENT.md.
+**Engine / Evidence** (statute §3.3, §4). Deterministic API over one modeled
+concept — the audit event. Declared in `INTENT.md` frontmatter and `layer.yaml`.
+
+Audit Core is **not** a PDP, not a PIP, and not PEP-shaped. It renders no
+decision, supplies no claim a decision consumes, and causes no protected side
+effect of its own.
 
 ## In Scope
 
-- Maintain the repository's primary implementation.
-- Keep docs, tests, and operational metadata current.
-- Operational audit custody (`operations.audit`) and its declared recovery bound.
+**Custody and integrity**
+
+- Event ingestion, validation, normalization to the Audit Core envelope,
+  redaction, and append-only operational custody.
+- Sender registration and binding; tenant and scope attribution.
+- Hash-chain integrity: link, verify, chain-head attestation, and the
+  `GET /v1/integrity` operator surface.
+- The honest custody claim — `custody_class`, `immutable`, `tamper_evidence`,
+  `recoverable_days` — stated at no more than `docs/integrity.md` delivers.
+- Retention profiles, search and export entitlements, dead-letter and
+  secret-finding surfaces.
+
+**Evidence-role obligations under v0.7 §9.6** *(largely not yet built — see
+`workplans/AUDIT-WP-0009-evidence-role-conformance.md`)*
+
+- Recording, per source, whether its evidence is **load-bearing** or
+  **attributive**, because the obligations differ.
+- Accepting and storing a source's declared **emission cadence**, and raising a
+  finding when the stream falls below it — the stream observed, not only its
+  contents.
+- **Heartbeat** ingestion and missing-heartbeat findings for low-volume
+  load-bearing classes, where rate monitoring cannot work.
+- A **reconciliation** surface: per-source, per-class event counts a source can
+  compare against its own state transitions.
+- Registering `approval-engine` as a distinct source carrying issuance, use,
+  supersession, and revocation (§9.4, `AUDIT-IN-0001`).
+
+**Conformance**
+
+- Machine-readable layer declaration (`layer.yaml`) and a conformance test.
+- A total list of infrastructure contacts, catalogued or not, so the §5 check
+  is total rather than vacuous.
 
 ## Out of Scope
 
-- Own unrelated adjacent systems.
-- Make irreversible operational decisions without human approval.
-- Procuring or operating S3 / Barman / WAL.
-- Booked cost or a second usage stream for `platform:audit-storage`.
+**Boundaries fixed by the statute — these are permanent, not "not yet"**
+
+- **Any authorization decision.** `access-engine` is the only decision point
+  (§6). Audit Core renders and caches none.
+- **An approval-validity query.** Records, yes; a verdict on whether an approval
+  is still valid, never (§9.4). A consumer branching on such an answer would
+  route an authorization decision through the audit fabric.
+- **Operative approval state** — the durable object, atomic supersession, single
+  consumption, revocation. That is `approval-engine`'s (§9.4).
+- **Emission atomicity at the source.** Completeness at the boundary is the
+  emitter's obligation; an archive cannot retrofit it (§9.6).
+- **Any claim that the archive proves an event occurred, or that absence proves
+  it did not** (§9.6).
+- **Policy decision making**, per `INTENT.md`.
+
+**Not owned here**
+
+- Procuring or operating S3 / Barman / WAL; the `platform:audit-storage` booked
+  cost or a second usage stream.
+- WORM, object lock, or ITC-CAP `data.archive`. Ruled a different store with a
+  different owner (statute §16); the stronger-custody gap is withdrawn, not
+  pending.
 - A `rapp.yaml` in this repo (schema requires `rapp-*`).
 - Public ingest.
+- Unrelated adjacent systems; irreversible operational decisions without human
+  approval.
 
 ## Current State
 
-- Status: production
-- Production receiver on railiance01 (`namespace audit-core`), Postgres
+- Status: production. Receiver on railiance01 (`namespace audit-core`), Postgres
   operational custody on `platform-pg`, sender `user-engine`.
-- Recovery is the platform `data.backup` window (30 days). Live `/readyz`
-  reports `custody_class=operational`, `tamper_evidence=true`,
-  `recoverable_days=30` (image `sha256:7febc28e…`).
+- Recovery is the platform `data.backup` window (30 days). `/readyz` reports
+  `custody_class=operational`, `recoverable_days=30`.
 - Hash chain verified on 30 live events
   (`docs/evidence/chain-head-20260816.json`).
 - ITC-CAP case: `data/capability/audit-core-operational.json` at D4.
-  `data.archive` is an unmet requirement.
-- Tenancy posture: `tenancy.yaml` (NetKingdom Tenancy Posture v0.1 draft-8,
-  Decision 5.4). Declared `I1 A2 E1 P1 R1`, target `E3` and `R2`. E is quoted
-  at 1 although the E2 mechanism is in place on both paths — the §13 E2
-  artifact is adversarial and does not exist yet (AUDIT-WP-0008-T05).
+- Tenancy posture: `tenancy.yaml` — declared `I1 A2 E1 P1 R1`, target `E3`/`R2`.
+
+**Known conformance gaps** (assessed 2026-08-29,
+`history/2026-08-29-v0.7-alignment-and-scope-assessment.md`):
+
+- `tamper_evidence=True` is returned unconditionally by the Postgres backend
+  while `docs/integrity.md` permits it only when a live external attestation
+  exists. The one attestation on record is 2026-08-16 and no job renews it.
+  This is Audit Core overclaiming its own bound — the §9.6 defect turned inward.
+- No cadence, heartbeat, reconciliation, or load-bearing classification exists.
+  The §9.6 obligations Audit Core argued for are not yet supportable by Audit
+  Core.
+- `approval-engine` is not yet registered as a source.
+- No negative test asserts the absence of an approval-validity surface.
 
 ## Getting Oriented
 
-- Start with: INTENT.md
-- Agent instructions: AGENTS.md
-- Workplans: workplans/
+- Start with: `INTENT.md`, then `net-kingdom/SECURITY-COMPANION.md`
+- Bound on what may be claimed: `docs/integrity.md`
+- Agent instructions: `AGENTS.md`
+- Workplans: `workplans/`