flex-auth/docs/conformance/boundaries-review.md

# Boundaries review — flex-auth against its security-relevant counterparts

> **Derived artifact** (§11). Derives from
> `net-kingdom/canon/standards/security-layer-model_v0.8.md`
> (`status: proposed`, `source_revision: gate-house@516ed4e`), from each
> counterpart's `INTENT.md` / `layer.yaml` as of the date below, and from
> flex-auth's own `decisions/decisions.md`.
> Derived at: **2026-09-21**. Reviewer: `flex-auth` (Engine / PDP).
> Carried by `FLEX-WP-0030`.

## Why this exists

`INTENT.md` was carrying a standard version it should not (`FLEX-WP-0030` T01).
Fixing one line meant reading what the declaration actually asserts, and the
declaration asserts a boundary — which is only half of a boundary. The other half
is held by someone else, and flex-auth had never checked whether the other halves
were stated at all.

They are not, in four cases. That is the finding of this review, and it was not
the one being looked for.

## The rule this review holds itself to

§11 is explicit: *"A layer stated **about** a repository by another repository is
not a declaration."* So nothing below grades a peer. flex-auth reports what it can
observe from outside, names the owner, and says which of three states the boundary
is in. **`unstated` is not recorded as `agreed`** — that conflation is the whole
reason the four cases below went unnoticed.

## Boundary status

| Counterpart | Boundary | State |
| --- | --- | --- |
| `gate-house` | owns invariants, authority ceilings, operating modes; flex-auth authors no doctrine and consumes authority context as claims | **agreed in substance, undeclared in form** — no `layer:` key (B2) |
| `key-cape` / NetKingdom SSO | identity source; flex-auth consumes verified claims as normative input and never redefines them | **asserted from one side only** — no `layer:` key (B2) |
| `ops-warden` | consumer / PEP; owns SSH CA, OpenBao signing, actor inventory and its own stance map. flex-auth owns the decision, never the credential | **agreed, and the most exercised boundary in the estate** |
| `secrets-engine` | consumer / PEP; owns credential lifecycle downstream of a decision | **agreed** |
| `approval-engine` | owns the approval object, its storage and lifecycle; flex-auth validates approvals as input claims and never mutates them | **agreed** — `GH-DEC-2026-005`, accepted in `FLEX-DEC-2026-006` against flex-auth's own proposal |
| `zone-engine` | zone **membership** compiles into the registry snapshot flex-auth consumes; per-zone **stance** is the consumer's | **held by flex-auth since 2026-08-19; not contested, not confirmed** |
| `user-engine` | PIP; supplies subject facts | **agreed** |
| `tenant-engine` | PIP and consumer. What `CheckRequest.tenant` denotes on the write API — caller, target, or guardrail scope — is **unanswered since 2026-09-15** | **unclear, and live** — `FLEX-WP-0022`, re-asked 2026-09-20 |
| `audit-core` | records evidence; flex-auth produces the decision record | **unclear** — which of the two is the §4 *source of evidence* decides whether flex-auth owes an emission guarantee (B3 / G2) |
| `maturity-engine` | PIP; supplies maturity claims. §9.5 forbids ranking blocked-clean below conforming | **agreed** |
| `kings-guard` | Staff; raised the authentication/assurance evidence gap that flex-auth **declined** (§13, `FLEX-DEC-2026-002`) | **agreed, by mutual declining** |
| `ops-mason` | catalogued PEP-shaped in §4 | **undeclared twice over** — no stance map (§13.1 marks it), no `layer:` key (B2) |

## Findings raised for resolution

Full statements in `workplans/FLEX-WP-0030-boundary-declaration-cleanup.md` T04.

| # | Finding | Owner |
| --- | --- | --- |
| B1 | `layer:` casing is inconsistent across ten declarations; §11 calls the check mechanical, and flex-auth's own validator would fail eight of them | `gate-house` |
| B2 | `gate-house`, `key-cape`, `ops-mason`, `net-kingdom` carry no machine-readable layer declaration | each named repository |
| B3 | flex-auth declares no emission guarantee; whether it owes one turns on an unruled boundary with `audit-core` | `gate-house`, `audit-core` |
| B4 | a layer declaration should not pin a standard version; if §11 agrees it should say so generally | `gate-house` |
| B5 | canon names `access-engine`; the repository still answers to `flex-auth` and the rename has not landed | `gate-house` to note |

## What flex-auth is not claiming

- **Not a conformance finding against anyone.** B1 and B2 are observations about
  form. A repository may be entirely conformant in substance and simply not have
  written the key; `gate-house` is the clearest case.
- **Not a request that any peer change casing.** B1 may equally be resolved by
  ruling the vocabulary case-insensitive, which would make flex-auth's validator
  the thing that changes.
- **Not a grade.** §9.3's two-owner split is flex-auth's own finding and it cuts
  here: the PDP does not get to score the repositories whose facts it consumes.
Make the layer declaration a boundary, and review the boundaries it implies. INTENT.md pinned standard_version: "0.7" in the frontmatter §11 requires. That conflated two things the standard separates itself: assent "records assent to a BOUNDARY, given at the version named. It is not assent to the current text." flex-auth is Engine/PDP at v0.6, v0.7, v0.8 and after; the role does not change when the text is amended. The field was also decorative — parsed into Declaration.StandardVersion and never validated — so the version was load-bearing only via a test asserting it equalled 0.7. That test is inverted rather than deleted: internal/layer now rejects a version pin in the declaration and requires conformance_record to name a file that exists. Version-scoped state moves to docs/conformance/security-layer-conformance.md, a derived artifact carrying what it derives from and the version derived at, as §11 requires of derived artifacts. SCOPE.md: gap assessment replaces "conforming with one declared gap" with three gaps, each with an owner and a route. G2 is new — flex-auth declares no emission guarantee where §11 requires one of every §4 source of evidence. It is recorded as a gap rather than as conformance because the flattering reading, that audit-core is the source and flex-auth merely produces, has been asserted by nobody but flex-auth. Also corrects the stance register from two rows to five. Fixing one line meant reading what the declaration asserts, and a boundary is only half held here. docs/conformance/boundaries-review.md checks the other halves across twelve counterparts and finds four security-relevant repositories with no layer declaration at all — including key-cape, the identity source whose claims flex-auth consumes as normative input. That boundary is asserted from one side only. Recorded as unstated, never as agreed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 28468@bnt-lap001 Assistant-Session: c76569b2-6056-4dad-aea4-49cd7a018f5d 2026-09-21 00:11:56 +02:00			`# Boundaries review — flex-auth against its security-relevant counterparts`

			`> Derived artifact (§11). Derives from`
			> `net-kingdom/canon/standards/security-layer-model_v0.8.md`
			> (`status: proposed`, `source_revision: gate-house@516ed4e`), from each
			> counterpart's `INTENT.md` / `layer.yaml` as of the date below, and from
			> flex-auth's own `decisions/decisions.md`.
			> Derived at: 2026-09-21. Reviewer: `flex-auth` (Engine / PDP).
			> Carried by `FLEX-WP-0030`.

			`## Why this exists`

			`INTENT.md` was carrying a standard version it should not (`FLEX-WP-0030` T01).
			`Fixing one line meant reading what the declaration actually asserts, and the`
			`declaration asserts a boundary — which is only half of a boundary. The other half`
			`is held by someone else, and flex-auth had never checked whether the other halves`
			`were stated at all.`

			`They are not, in four cases. That is the finding of this review, and it was not`
			`the one being looked for.`

			`## The rule this review holds itself to`

			`§11 is explicit: "A layer stated about* a repository by another repository is`
			`not a declaration."* So nothing below grades a peer. flex-auth reports what it can`
			`observe from outside, names the owner, and says which of three states the boundary`
			is in. `unstated` is not recorded as `agreed` — that conflation is the whole
			`reason the four cases below went unnoticed.`

			`## Boundary status`

			`\| Counterpart \| Boundary \| State \|`
			`\| --- \| --- \| --- \|`
			\| `gate-house` \| owns invariants, authority ceilings, operating modes; flex-auth authors no doctrine and consumes authority context as claims \| agreed in substance, undeclared in form — no `layer:` key (B2) \|
			\| `key-cape` / NetKingdom SSO \| identity source; flex-auth consumes verified claims as normative input and never redefines them \| asserted from one side only — no `layer:` key (B2) \|
			\| `ops-warden` \| consumer / PEP; owns SSH CA, OpenBao signing, actor inventory and its own stance map. flex-auth owns the decision, never the credential \| agreed, and the most exercised boundary in the estate \|
			\| `secrets-engine` \| consumer / PEP; owns credential lifecycle downstream of a decision \| agreed \|
			\| `approval-engine` \| owns the approval object, its storage and lifecycle; flex-auth validates approvals as input claims and never mutates them \| agreed — `GH-DEC-2026-005`, accepted in `FLEX-DEC-2026-006` against flex-auth's own proposal \|
			\| `zone-engine` \| zone membership compiles into the registry snapshot flex-auth consumes; per-zone stance is the consumer's \| held by flex-auth since 2026-08-19; not contested, not confirmed \|
			\| `user-engine` \| PIP; supplies subject facts \| agreed \|
			\| `tenant-engine` \| PIP and consumer. What `CheckRequest.tenant` denotes on the write API — caller, target, or guardrail scope — is unanswered since 2026-09-15 \| unclear, and live — `FLEX-WP-0022`, re-asked 2026-09-20 \|
			\| `audit-core` \| records evidence; flex-auth produces the decision record \| unclear — which of the two is the §4 source of evidence decides whether flex-auth owes an emission guarantee (B3 / G2) \|
			\| `maturity-engine` \| PIP; supplies maturity claims. §9.5 forbids ranking blocked-clean below conforming \| agreed \|
			\| `kings-guard` \| Staff; raised the authentication/assurance evidence gap that flex-auth declined (§13, `FLEX-DEC-2026-002`) \| agreed, by mutual declining \|
			\| `ops-mason` \| catalogued PEP-shaped in §4 \| undeclared twice over — no stance map (§13.1 marks it), no `layer:` key (B2) \|

			`## Findings raised for resolution`

			Full statements in `workplans/FLEX-WP-0030-boundary-declaration-cleanup.md` T04.

			`\| # \| Finding \| Owner \|`
			`\| --- \| --- \| --- \|`
			\| B1 \| `layer:` casing is inconsistent across ten declarations; §11 calls the check mechanical, and flex-auth's own validator would fail eight of them \| `gate-house` \|
			\| B2 \| `gate-house`, `key-cape`, `ops-mason`, `net-kingdom` carry no machine-readable layer declaration \| each named repository \|
			\| B3 \| flex-auth declares no emission guarantee; whether it owes one turns on an unruled boundary with `audit-core` \| `gate-house`, `audit-core` \|
			\| B4 \| a layer declaration should not pin a standard version; if §11 agrees it should say so generally \| `gate-house` \|
			\| B5 \| canon names `access-engine`; the repository still answers to `flex-auth` and the rename has not landed \| `gate-house` to note \|

			`## What flex-auth is not claiming`

			`- Not a conformance finding against anyone. B1 and B2 are observations about`
			`form. A repository may be entirely conformant in substance and simply not have`
			written the key; `gate-house` is the clearest case.
			`- Not a request that any peer change casing. B1 may equally be resolved by`
			`ruling the vocabulary case-insensitive, which would make flex-auth's validator`
			`the thing that changes.`
			`- Not a grade. §9.3's two-owner split is flex-auth's own finding and it cuts`
			`here: the PDP does not get to score the repositories whose facts it consumes.`