emergent-security/knowledge/cards/construction.md

Building security infrastructure

ops-mason owns construction planning: describe the required route, compare existing structure, review a concrete plan, render the human decision, then build only within the accepted plan. ops-warden routes needs to that construction path.

Its current owner declaration records a founder-accepted plan-approval exception for specific structure-only effects, not access-engine-based conformance and not permission for new classes of effects. Revalidate the exact declaration and decision before work. Do not attach an invented fail-closed PDP stance to a path that does not consult the PDP.

The build-mode directive authorizes fixing incomplete/misrouted controls within the task's scope. It is not a general exception to human decisions, production change authorization, secret handling, or harness permissions. Record each relaxation and unarmed control in the owned close-down process with its re-arm condition. Scope or policy conflicts require a concrete decision, not an agent patching policy to authorize itself. This package does not execute construction.

Source owner IDs (cite the relevant owner, not an invented umbrella): ops-mason, ops-warden, the-custodian.