# Boundaries review — flex-auth against its security-relevant counterparts

> **Derived artifact** (§11). Derives from
> `net-kingdom/canon/standards/security-layer-model_v0.8.md`
> (`status: proposed`, `source_revision: gate-house@516ed4e`), from each
> counterpart's `INTENT.md` / `layer.yaml` as of the date below, and from
> flex-auth's own `decisions/decisions.md`.
> Derived at: **2026-09-21**. Reviewer: `flex-auth` (Engine / PDP).
> Carried by `FLEX-WP-0030`.

## Why this exists

`INTENT.md` was carrying a standard version it should not (`FLEX-WP-0030` T01).
Fixing one line meant reading what the declaration actually asserts, and the
declaration asserts a boundary — which is only half of a boundary. The other half
is held by someone else, and flex-auth had never checked whether the other halves
were stated at all.

They are not, in four cases. That is the finding of this review, and it was not
the one being looked for.

## The rule this review holds itself to

§11 is explicit: *"A layer stated **about** a repository by another repository is
not a declaration."* So nothing below grades a peer. flex-auth reports what it can
observe from outside, names the owner, and says which of three states the boundary
is in. **`unstated` is not recorded as `agreed`** — that conflation is the whole
reason the four cases below went unnoticed.

## Boundary status

| Counterpart | Boundary | State |
| --- | --- | --- |
| `gate-house` | owns invariants, authority ceilings, operating modes; flex-auth authors no doctrine and consumes authority context as claims | **agreed in substance, undeclared in form** — no `layer:` key (B2) |
| `key-cape` / NetKingdom SSO | identity source; flex-auth consumes verified claims as normative input and never redefines them | **asserted from one side only** — no `layer:` key (B2) |
| `ops-warden` | consumer / PEP; owns SSH CA, OpenBao signing, actor inventory and its own stance map. flex-auth owns the decision, never the credential | **agreed, and the most exercised boundary in the estate** |
| `secrets-engine` | consumer / PEP; owns credential lifecycle downstream of a decision | **agreed** |
| `approval-engine` | owns the approval object, its storage and lifecycle; flex-auth validates approvals as input claims and never mutates them | **agreed** — `GH-DEC-2026-005`, accepted in `FLEX-DEC-2026-006` against flex-auth's own proposal |
| `zone-engine` | zone **membership** compiles into the registry snapshot flex-auth consumes; per-zone **stance** is the consumer's | **held by flex-auth since 2026-08-19; not contested, not confirmed** |
| `user-engine` | PIP; supplies subject facts | **agreed** |
| `tenant-engine` | PIP and consumer. What `CheckRequest.tenant` denotes on the write API — caller, target, or guardrail scope — is **unanswered since 2026-09-15** | **unclear, and live** — `FLEX-WP-0022`, re-asked 2026-09-20 |
| `audit-core` | holds custody of evidence; flex-auth **emits** the decision record | **ruled 2026-09-21, against flex-auth** — flex-auth is the §4 source; custody is never source (`GH-DEC-2026-018`); `audit-core` confirmed independently and declined the role (`AUDIT-IN-0005`). G2 is now a dated gap |
| `maturity-engine` | PIP; supplies maturity claims. §9.5 forbids ranking blocked-clean below conforming | **agreed** |
| `kings-guard` | Staff; raised the authentication/assurance evidence gap that flex-auth **declined** (§13, `FLEX-DEC-2026-002`) | **agreed, by mutual declining** |
| `ops-mason` | catalogued PEP-shaped in §4 | **undeclared twice over** — no stance map (§13.1 marks it), no `layer:` key (B2) |

## Findings raised for resolution

Full statements in `workplans/FLEX-WP-0030-boundary-declaration-cleanup.md` T04.

| # | Finding | Owner | Outcome |
| --- | --- | --- | --- |
| B1 | **Corrected 2026-09-21.** Nine of nine repositories carrying both §11 forms declare a different `layer:` value in each. §11 does not say which form governs | `gate-house` | **Ruled** `GH-DEC-2026-017` §1–§2: `INTENT.md` governs, sidecar is derived and must agree, the disagreement is still reported; comparison folds ASCII case. flex-auth's validator changed |
| B2 | `gate-house`, `key-cape`, `ops-mason`, `net-kingdom` carry no machine-readable layer declaration | each named repository | `gate-house` declared `Staff` in the ruling commit; three remain |
| B3 | flex-auth declares no emission guarantee; whether it owes one turns on an unruled boundary with `audit-core` | `gate-house`, `audit-core` | **Ruled against flex-auth** `GH-DEC-2026-018`; per-class inventory published in `cadence.yaml`; delivery is dated gap G2 |
| B4 | a layer declaration should not pin a standard version; if §11 agrees it should say so generally | `gate-house` | **Ruled as asked** `GH-DEC-2026-017` §5, A12 |
| B5 | canon names `access-engine`; the repository still answers to `flex-auth` and the rename has not landed | `gate-house` to note | A13 notes it; ping when `FLEX-WP-0020` lands |

## What flex-auth is not claiming

- **Not a conformance finding against anyone.** B1 and B2 are observations about
  form. A repository may be entirely conformant in substance and simply not have
  written the key; `gate-house` is the clearest case.
- **Not a request that any peer change casing.** B1 may equally be resolved by
  ruling the vocabulary case-insensitive, which would make flex-auth's validator
  the thing that changes. *(It was, and it did — see the second correction.)*
- **Not a grade.** §9.3's two-owner split is flex-auth's own finding and it cuts
  here: the PDP does not get to score the repositories whose facts it consumes.

## Correction — B1, 2026-09-21

**The first published version of B1 was wrong, and it was wrong in a way this
review exists to prevent.**

It reported that the estate spelled `layer:` three ways *across* repositories,
and named eight as non-conformant on casing. That came from an ad-hoc shell
survey run while writing this document. The survey took the first `^layer:` match
per repository across two files without recording which file it came from, so it
reported one value where there were two.

Re-run mechanically (`tools/survey_layer_declarations.go`, receipt at
`docs/evidence/2026-09-21-layer-declaration-survey.json`), the finding is
different and stronger:

| | |
| --- | --- |
| Repositories carrying **both** §11 forms | 9 |
| Of those, forms that **disagree** | **9 of 9** |
| Shape | `INTENT.md` says `Engine` / `Staff`; `layer.yaml` says `engine` / `staff` |
| Repositories with only one form | 1 — `flex-auth`, which has no `layer.yaml` |

The disagreement is **within** each repository, between the two forms §11
permits, and it is universal rather than sloppy — two generators, two
conventions, no repository mixing them. Nobody is inconsistent with anybody else.

That relocates the question. §11 accepts *"a `layer:` key in the `INTENT.md`
frontmatter, **or** an equivalent declaration file"* and does not say which
governs when a repository carries both and they disagree. A conformance run
reading `INTENT.md` and one reading `layer.yaml` reach different answers for nine
repositories, and both are following §11.

flex-auth is the only declared repository that cannot exhibit this, and only
because it never wrote the second file — not a virtue.

**What this cost.** The wrong version went to `gate-house` and five engine
repositories before it was checked. Corrections were sent the same day. The
review had already said a mechanical check nobody can re-run is an assertion, and
then asserted B1 from a shell pipeline — which is why B1 is now a command with
tests and a receipt, and why this correction is recorded here rather than edited
away. A published review corrected silently is `FLEX-DEC-2026-008`'s defect, and
that rule does not have an exception for the reviewer.


## Correction — the validator, 2026-09-21

**This review treated flex-auth's validator as the §3 vocabulary. It was not,
and it was wrong.**

`internal/layer` admitted `{Staff, Engine, Tooling}`. §3 enumerates **four**
layers — Taxonomy, Tooling, Engines, Staff — and §3.1 defines Taxonomy, which
§4 catalogues twice (`info-tech-canon`, `net-kingdom`) and which the standard
itself is an instance of. The three-token set was built from §4's role-typed
catalog rows rather than from §3's layer table, so it took §4's spelling
(`Engine`) and lost §3's fourth row. Where this review and its survey said
"outside the §3 vocabulary as written", they meant "outside flex-auth's
validator", and the difference is the finding.

**`railiance-master`'s `Taxonomy` declaration was conforming all along; the
validator was the divergent artifact.** `railiance-master` said so with the
citations (§3.1, §4, §7, §17) against a record that had named it
non-conformant. `GH-DEC-2026-017` §3 ruled the same.

How it happened is §11's derived-artifact rule inverted: an artifact derived
from canon came to stand in for canon, because canon left the token set to be
inferred from two tables that disagree and the validator was the only
executable statement of one. flex-auth wrote that artifact.

**Fixed** in `internal/layer`, per `GH-DEC-2026-017` §2–§4 and A9, A11:

- four tokens, closed: `Taxonomy`, `Tooling`, `Engine`, `Staff`;
- ASCII case folded before comparing; a lowercase declaration is conforming;
- §4's column spelling is canonical, so `engine` reports as `Engine` and
  `Engines` (§3's plural heading) is not the token;
- `INTENT.md` governs; a disagreement between the two forms is still reported,
  and a spelling-only disagreement is distinguished from a disagreement about a
  layer (there are nine of the first and none of the second);
- **a run states its scope.** §11 binds §4. The survey now leads with its scope
  (`estate-wide` or `§4 catalog`, `--catalog-only`), and reports a repository
  outside §4 that declares as *declared voluntarily, outside catalog scope* —
  never as a non-conformance. This review's own survey was estate-wide over
  fourteen counterparts and said nothing about which question it answered.

A second defect surfaced while fixing the first: the survey decoded peers'
files into flex-auth's own declaration struct, so a peer field sharing a name
with one of flex-auth's in a different shape (`audit-core`'s list-shaped
`emission_guarantee`) made that peer's `layer.yaml` silently disappear. Peers
are now read for `layer` and `role` only. A surveyor's schema is a house rule
too. Receipt: `docs/evidence/2026-09-21-layer-declaration-survey-after-ghdec017.json`.