Review security layer model v0.6 — assent, three findings

All three v0.4 findings landed in v0.5 (local outbox, machine-readable
declaration, §14 arithmetic). §9.6's load-bearing/attributive split and
§16's ruling on approval custody both improve on what audit-core raised.

Findings, all correcting audit-core's own contribution: (1) the local
outbox closes accidental omission, not the compromised-source case §9.6
opens with — a compromised emitter can decline the insert or drop the row
before drain; §16 rests a ruling on that conflation. (2) cadence is the
only control touching the residual and is a SHOULD, and rate-based
detection is weakest for the rare negative events §9.6 says matter most —
recommend positive reconciliation for load-bearing low-volume classes.
(3) §3.3's Evidence row states an availability/independence trade as a
property of evidence engines.

Adds layer.yaml in ops-warden's reference form, per §11.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpeL68AWHqtqPQZEXY5kFe

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4040362@bnt-lap001
Assistant-Session: 4fd0fd24-2ee8-4413-bd67-43bd79ca73f1

layer.yaml

@@ -0,0 +1,46 @@
+# audit-core — NetKingdom security layer declaration
+#
+# Framework: net-kingdom/canon/standards/security-layer-model_v0.6.md
+# Assent:    AUDIT-IN-0001 (audit-core's own voice, per §11 "who must declare")
+#            history/2026-08-28-approval-evidence-assent.md
+#            history/2026-08-29-security-layer-model-v0.6-review.md
+#
+# Reference form offered by ops-warden and adopted here, so §11's declaration
+# check is mechanical rather than a reader's judgment about prose. audit-core
+# raised that defect; adopting the form is the other half of raising it.
+
+schema_version: "0.1"
+framework: netkingdom-security-layer-model
+standard_version: "0.6"
+repository: audit-core
+layer: engine
+role: evidence                        # §3.3 engine typing
+declared_by: intakes/intakes.md AUDIT-IN-0001
+declared_at: "2026-08-29"
+
+# §3.3: an Evidence engine records what happened and proves integrity of what
+# it holds. It is explicitly not a decision point (§6, §9.4).
+decision_surfaces_exposed: none
+
+# §9.4 — normative and permanent. audit-core exposes no verdict on whether an
+# approval is still valid; a consumer branching on such an answer would route an
+# authorization decision through the audit fabric.
+approval_validity_query: forbidden
+
+# §5 applies to Staff. audit-core is an Engine and holds no Tooling contact
+# requiring a §5.1/§5.2/§5.3 declaration. Its PostgreSQL custody is its own
+# operational store, not a §4 Tooling row.
+tooling_contacts: []
+
+# §9.6 — the bound audit-core delivers, stated so no doctrine rests on more.
+evidence_bound:
+  proves:
+    - records held were not altered after arrival
+    - records held were not truncated after arrival
+  does_not_prove:
+    - that a record was ever sent
+    - absence of a record as evidence of non-occurrence
+  conditional_on:
+    - external chain-head attestation stored outside platform-pg
+  contract: docs/integrity.md
+  not_claimed: [WORM, object-lock, archival-custody]