tegwick
e8d6d08f79
B1 was found with a shell pipeline and published as a finding. The review it appeared in had already argued that a mechanical check nobody can re-run is an assertion, and §11's entire claim is mechanical checkability — so asserting B1 unmechanically was that defect committed by the repository reporting it. tools/survey_layer_declarations.go reads both §11 forms per repository, reports intra-repository disagreement, and writes a receipt. Run once, it showed the published B1 was wrong: the estate does not spell layer: three ways across repositories. The original pipeline took the first ^layer: match per repository without recording which file it came from, reporting one value where there were two. The corrected finding is stronger. Nine of nine repositories carrying both §11 forms declare a different value in each: INTENT.md says Engine/Staff, layer.yaml says engine/staff. The disagreement is within each repository, between the two forms §11 permits, and it is universal rather than careless — two generators, two conventions. Nobody is inconsistent with anybody else. That relocates the question from casing to precedence: §11 accepts either form and does not say which governs when both exist and disagree, so a conformance run reading INTENT.md and one reading layer.yaml reach different answers for nine repositories while both follow §11. flex-auth is the only declared repository that cannot exhibit this, and only because it never wrote the second file. The correction is recorded in the review rather than edited away: a published review corrected silently is FLEX-DEC-2026-008's defect, and that rule has no exception for the reviewer. Four tests cover the disagreement case, the refusal to fold case, a missing declaration, and the single-form shape that must not read as self-disagreement. The survey checks only the §3 vocabulary and never applies flex-auth's house rules to peers. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 28468@bnt-lap001 Assistant-Session: c76569b2-6056-4dad-aea4-49cd7a018f5d
7.1 KiB
Boundaries review — flex-auth against its security-relevant counterparts
Derived artifact (§11). Derives from
net-kingdom/canon/standards/security-layer-model_v0.8.md(status: proposed,source_revision: gate-house@516ed4e), from each counterpart'sINTENT.md/layer.yamlas of the date below, and from flex-auth's owndecisions/decisions.md. Derived at: 2026-09-21. Reviewer:flex-auth(Engine / PDP). Carried byFLEX-WP-0030.
Why this exists
INTENT.md was carrying a standard version it should not (FLEX-WP-0030 T01).
Fixing one line meant reading what the declaration actually asserts, and the
declaration asserts a boundary — which is only half of a boundary. The other half
is held by someone else, and flex-auth had never checked whether the other halves
were stated at all.
They are not, in four cases. That is the finding of this review, and it was not the one being looked for.
The rule this review holds itself to
§11 is explicit: "A layer stated about a repository by another repository is
not a declaration." So nothing below grades a peer. flex-auth reports what it can
observe from outside, names the owner, and says which of three states the boundary
is in. unstated is not recorded as agreed — that conflation is the whole
reason the four cases below went unnoticed.
Boundary status
| Counterpart | Boundary | State |
|---|---|---|
gate-house |
owns invariants, authority ceilings, operating modes; flex-auth authors no doctrine and consumes authority context as claims | agreed in substance, undeclared in form — no layer: key (B2) |
key-cape / NetKingdom SSO |
identity source; flex-auth consumes verified claims as normative input and never redefines them | asserted from one side only — no layer: key (B2) |
ops-warden |
consumer / PEP; owns SSH CA, OpenBao signing, actor inventory and its own stance map. flex-auth owns the decision, never the credential | agreed, and the most exercised boundary in the estate |
secrets-engine |
consumer / PEP; owns credential lifecycle downstream of a decision | agreed |
approval-engine |
owns the approval object, its storage and lifecycle; flex-auth validates approvals as input claims and never mutates them | agreed — GH-DEC-2026-005, accepted in FLEX-DEC-2026-006 against flex-auth's own proposal |
zone-engine |
zone membership compiles into the registry snapshot flex-auth consumes; per-zone stance is the consumer's | held by flex-auth since 2026-08-19; not contested, not confirmed |
user-engine |
PIP; supplies subject facts | agreed |
tenant-engine |
PIP and consumer. What CheckRequest.tenant denotes on the write API — caller, target, or guardrail scope — is unanswered since 2026-09-15 |
unclear, and live — FLEX-WP-0022, re-asked 2026-09-20 |
audit-core |
records evidence; flex-auth produces the decision record | unclear — which of the two is the §4 source of evidence decides whether flex-auth owes an emission guarantee (B3 / G2) |
maturity-engine |
PIP; supplies maturity claims. §9.5 forbids ranking blocked-clean below conforming | agreed |
kings-guard |
Staff; raised the authentication/assurance evidence gap that flex-auth declined (§13, FLEX-DEC-2026-002) |
agreed, by mutual declining |
ops-mason |
catalogued PEP-shaped in §4 | undeclared twice over — no stance map (§13.1 marks it), no layer: key (B2) |
Findings raised for resolution
Full statements in workplans/FLEX-WP-0030-boundary-declaration-cleanup.md T04.
| # | Finding | Owner |
|---|---|---|
| B1 | Corrected 2026-09-21. Nine of nine repositories carrying both §11 forms declare a different layer: value in each. §11 does not say which form governs |
gate-house |
| B2 | gate-house, key-cape, ops-mason, net-kingdom carry no machine-readable layer declaration |
each named repository |
| B3 | flex-auth declares no emission guarantee; whether it owes one turns on an unruled boundary with audit-core |
gate-house, audit-core |
| B4 | a layer declaration should not pin a standard version; if §11 agrees it should say so generally | gate-house |
| B5 | canon names access-engine; the repository still answers to flex-auth and the rename has not landed |
gate-house to note |
What flex-auth is not claiming
- Not a conformance finding against anyone. B1 and B2 are observations about
form. A repository may be entirely conformant in substance and simply not have
written the key;
gate-houseis the clearest case. - Not a request that any peer change casing. B1 may equally be resolved by ruling the vocabulary case-insensitive, which would make flex-auth's validator the thing that changes.
- Not a grade. §9.3's two-owner split is flex-auth's own finding and it cuts here: the PDP does not get to score the repositories whose facts it consumes.
Correction — B1, 2026-09-21
The first published version of B1 was wrong, and it was wrong in a way this review exists to prevent.
It reported that the estate spelled layer: three ways across repositories,
and named eight as non-conformant on casing. That came from an ad-hoc shell
survey run while writing this document. The survey took the first ^layer: match
per repository across two files without recording which file it came from, so it
reported one value where there were two.
Re-run mechanically (tools/survey_layer_declarations.go, receipt at
docs/evidence/2026-09-21-layer-declaration-survey.json), the finding is
different and stronger:
| Repositories carrying both §11 forms | 9 |
| Of those, forms that disagree | 9 of 9 |
| Shape | INTENT.md says Engine / Staff; layer.yaml says engine / staff |
| Repositories with only one form | 1 — flex-auth, which has no layer.yaml |
The disagreement is within each repository, between the two forms §11 permits, and it is universal rather than sloppy — two generators, two conventions, no repository mixing them. Nobody is inconsistent with anybody else.
That relocates the question. §11 accepts "a layer: key in the INTENT.md
frontmatter, or an equivalent declaration file" and does not say which
governs when a repository carries both and they disagree. A conformance run
reading INTENT.md and one reading layer.yaml reach different answers for nine
repositories, and both are following §11.
flex-auth is the only declared repository that cannot exhibit this, and only because it never wrote the second file — not a virtue.
What this cost. The wrong version went to gate-house and five engine
repositories before it was checked. Corrections were sent the same day. The
review had already said a mechanical check nobody can re-run is an assertion, and
then asserted B1 from a shell pipeline — which is why B1 is now a command with
tests and a receipt, and why this correction is recorded here rather than edited
away. A published review corrected silently is FLEX-DEC-2026-008's defect, and
that rule does not have an exception for the reviewer.