Make the layer declaration a boundary, and review the boundaries it implies.

INTENT.md pinned standard_version: "0.7" in the frontmatter §11 requires. That
conflated two things the standard separates itself: assent "records assent to a
BOUNDARY, given at the version named. It is not assent to the current text."
flex-auth is Engine/PDP at v0.6, v0.7, v0.8 and after; the role does not change
when the text is amended. The field was also decorative — parsed into
Declaration.StandardVersion and never validated — so the version was load-bearing
only via a test asserting it equalled 0.7.

That test is inverted rather than deleted: internal/layer now rejects a version
pin in the declaration and requires conformance_record to name a file that
exists. Version-scoped state moves to docs/conformance/security-layer-conformance.md,
a derived artifact carrying what it derives from and the version derived at, as
§11 requires of derived artifacts.

SCOPE.md: gap assessment replaces "conforming with one declared gap" with three
gaps, each with an owner and a route. G2 is new — flex-auth declares no emission
guarantee where §11 requires one of every §4 source of evidence. It is recorded
as a gap rather than as conformance because the flattering reading, that
audit-core is the source and flex-auth merely produces, has been asserted by
nobody but flex-auth. Also corrects the stance register from two rows to five.

Fixing one line meant reading what the declaration asserts, and a boundary is
only half held here. docs/conformance/boundaries-review.md checks the other
halves across twelve counterparts and finds four security-relevant repositories
with no layer declaration at all — including key-cape, the identity source whose
claims flex-auth consumes as normative input. That boundary is asserted from one
side only. Recorded as unstated, never as agreed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 28468@bnt-lap001
Assistant-Session: c76569b2-6056-4dad-aea4-49cd7a018f5d

docs/conformance/boundaries-review.md

@@ -0,0 +1,68 @@
+# Boundaries review — flex-auth against its security-relevant counterparts
+
+> **Derived artifact** (§11). Derives from
+> `net-kingdom/canon/standards/security-layer-model_v0.8.md`
+> (`status: proposed`, `source_revision: gate-house@516ed4e`), from each
+> counterpart's `INTENT.md` / `layer.yaml` as of the date below, and from
+> flex-auth's own `decisions/decisions.md`.
+> Derived at: **2026-09-21**. Reviewer: `flex-auth` (Engine / PDP).
+> Carried by `FLEX-WP-0030`.
+
+## Why this exists
+
+`INTENT.md` was carrying a standard version it should not (`FLEX-WP-0030` T01).
+Fixing one line meant reading what the declaration actually asserts, and the
+declaration asserts a boundary — which is only half of a boundary. The other half
+is held by someone else, and flex-auth had never checked whether the other halves
+were stated at all.
+
+They are not, in four cases. That is the finding of this review, and it was not
+the one being looked for.
+
+## The rule this review holds itself to
+
+§11 is explicit: *"A layer stated **about** a repository by another repository is
+not a declaration."* So nothing below grades a peer. flex-auth reports what it can
+observe from outside, names the owner, and says which of three states the boundary
+is in. **`unstated` is not recorded as `agreed`** — that conflation is the whole
+reason the four cases below went unnoticed.
+
+## Boundary status
+
+| Counterpart | Boundary | State |
+| --- | --- | --- |
+| `gate-house` | owns invariants, authority ceilings, operating modes; flex-auth authors no doctrine and consumes authority context as claims | **agreed in substance, undeclared in form** — no `layer:` key (B2) |
+| `key-cape` / NetKingdom SSO | identity source; flex-auth consumes verified claims as normative input and never redefines them | **asserted from one side only** — no `layer:` key (B2) |
+| `ops-warden` | consumer / PEP; owns SSH CA, OpenBao signing, actor inventory and its own stance map. flex-auth owns the decision, never the credential | **agreed, and the most exercised boundary in the estate** |
+| `secrets-engine` | consumer / PEP; owns credential lifecycle downstream of a decision | **agreed** |
+| `approval-engine` | owns the approval object, its storage and lifecycle; flex-auth validates approvals as input claims and never mutates them | **agreed** — `GH-DEC-2026-005`, accepted in `FLEX-DEC-2026-006` against flex-auth's own proposal |
+| `zone-engine` | zone **membership** compiles into the registry snapshot flex-auth consumes; per-zone **stance** is the consumer's | **held by flex-auth since 2026-08-19; not contested, not confirmed** |
+| `user-engine` | PIP; supplies subject facts | **agreed** |
+| `tenant-engine` | PIP and consumer. What `CheckRequest.tenant` denotes on the write API — caller, target, or guardrail scope — is **unanswered since 2026-09-15** | **unclear, and live** — `FLEX-WP-0022`, re-asked 2026-09-20 |
+| `audit-core` | records evidence; flex-auth produces the decision record | **unclear** — which of the two is the §4 *source of evidence* decides whether flex-auth owes an emission guarantee (B3 / G2) |
+| `maturity-engine` | PIP; supplies maturity claims. §9.5 forbids ranking blocked-clean below conforming | **agreed** |
+| `kings-guard` | Staff; raised the authentication/assurance evidence gap that flex-auth **declined** (§13, `FLEX-DEC-2026-002`) | **agreed, by mutual declining** |
+| `ops-mason` | catalogued PEP-shaped in §4 | **undeclared twice over** — no stance map (§13.1 marks it), no `layer:` key (B2) |
+
+## Findings raised for resolution
+
+Full statements in `workplans/FLEX-WP-0030-boundary-declaration-cleanup.md` T04.
+
+| # | Finding | Owner |
+| --- | --- | --- |
+| B1 | `layer:` casing is inconsistent across ten declarations; §11 calls the check mechanical, and flex-auth's own validator would fail eight of them | `gate-house` |
+| B2 | `gate-house`, `key-cape`, `ops-mason`, `net-kingdom` carry no machine-readable layer declaration | each named repository |
+| B3 | flex-auth declares no emission guarantee; whether it owes one turns on an unruled boundary with `audit-core` | `gate-house`, `audit-core` |
+| B4 | a layer declaration should not pin a standard version; if §11 agrees it should say so generally | `gate-house` |
+| B5 | canon names `access-engine`; the repository still answers to `flex-auth` and the rename has not landed | `gate-house` to note |
+
+## What flex-auth is not claiming
+
+- **Not a conformance finding against anyone.** B1 and B2 are observations about
+  form. A repository may be entirely conformant in substance and simply not have
+  written the key; `gate-house` is the clearest case.
+- **Not a request that any peer change casing.** B1 may equally be resolved by
+  ruling the vocabulary case-insensitive, which would make flex-auth's validator
+  the thing that changes.
+- **Not a grade.** §9.3's two-owner split is flex-auth's own finding and it cuts
+  here: the PDP does not get to score the repositories whose facts it consumes.

docs/conformance/security-layer-conformance.md

@@ -0,0 +1,72 @@
+# Security Layer Model — flex-auth conformance record
+
+> **Derived artifact** (§11). Derives from
+> `net-kingdom/canon/standards/security-layer-model_v0.8.md`
+> (`status: proposed`, `source_revision: gate-house@516ed4e`).
+> Derived at: **2026-09-21**. Maintained by `flex-auth`.
+
+This file exists because `INTENT.md` deliberately does not carry one. The layer
+declaration states a **boundary** — flex-auth is Engine / PDP — and a boundary
+does not change when the standard text is amended. Conformance state does change,
+every revision, and belongs in an artifact that is expected to move and that
+carries the version it was derived at.
+
+The split is the standard's own. Its frontmatter: *"`assented_by` records assent
+to a BOUNDARY, given at the version named. It is not assent to the current text."*
+
+## Declaration
+
+| Field | Value |
+| --- | --- |
+| Layer | `Engine` |
+| Role | `PDP` — the estate's only policy decision point (§6) |
+| Declared at | 2026-08-29 |
+| Declared by | `FLEX-DEC-2026-001`, `FLEX-DEC-2026-002`, `FLEX-DEC-2026-003` |
+| PEP stance | `null` — not PEP-shaped; flex-auth renders decisions and causes no protected side effect |
+| Tooling contacts | none — §5 binds Staff; flex-auth holds no Tooling client |
+
+## Assent history
+
+Assent is to the boundary, recorded at the version where it was given.
+
+| Version | Record | Outcome |
+| --- | --- | --- |
+| v0.4 | `FLEX-DEC-2026-002` | §9.3 contested and upheld |
+| v0.6 | `FLEX-DEC-2026-003` | review; §6.4.2, §9.7.2, §17 adopted into v0.7 |
+| v0.7 | — | four flex-auth findings adopted |
+| v0.8 (`proposed`) | `FLEX-DEC-2026-011` | assent with four findings, all adopted |
+
+## Conformance state at v0.8
+
+**Conforming, with declared gaps below.** §11's four states: conforming,
+blocked-clean, declared gap, undeclared violation. flex-auth claims no
+blocked-clean capability and holds no undeclared violation it is aware of.
+
+| # | Gap | Owner | Blocked on | Review |
+| --- | --- | --- | --- | --- |
+| G1 | Registry-snapshot digest absent from decision provenance. §9.7.2 promotes it to a conformance prerequisite: a decision that turned on registry content must be replayable from its own record. | `flex-auth` | implementation | `FLEX-WP-0019` |
+| G2 | **Emission guarantee not declared.** §11 requires every §4 repository catalogued as a source of evidence to declare class, cadence and detection surface in its machine-readable declaration, and says a source declaring none is not conforming. flex-auth declares none. | `gate-house` to rule, then `flex-auth` | whether flex-auth is a §4 *source of evidence* or only the producer of an artifact `audit-core` sources — see `FLEX-WP-0030` B3 | `FLEX-WP-0030-T04` |
+| G3 | Published stance-register review is stale: written at two register rows, §13.1 now carries five, and its Finding 1 was ruled by v0.8 §6.4 obligation 3. | `flex-auth` | second edition | `FLEX-WP-0029` |
+
+G2 is recorded as a gap rather than as conformance because the flattering reading
+— that `audit-core` is the source and flex-auth merely produces — has not been
+confirmed by anyone but flex-auth. §11 says a source that declares no emission
+guarantee is not conforming; until the boundary is ruled, the conservative entry
+is the honest one.
+
+## Not gaps
+
+- **No standard version in `INTENT.md`.** Deliberate, enforced by test
+  (`internal/layer`), and raised to `gate-house` as `FLEX-WP-0030` B4 in case §11
+  should say so generally.
+- **Canon says `access-engine`, the repository answers to `flex-auth`.** The
+  rename is ruled (`FLEX-DEC-2026-013`) and sequenced (`FLEX-WP-0020`); the
+  coordinate is pending, not broken. Raised as B5.
+
+## How this file is kept true
+
+`internal/layer` asserts that `INTENT.md` carries no `standard_version` and names
+a `conformance_record` that exists on disk. That is the same property flex-auth
+praised in `ops-warden`'s stance map: the published artifact is asserted equal to
+the shipped one by test, rather than merely written down. It does **not** assert
+the contents below the declaration — a reviewer still has to read this file.