From 8e7f012326d7e9556d09b7e4585c3dba27bd6c19 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 11 Oct 2026 02:21:40 +0200 Subject: [PATCH] Close verified v0.8 source flip and eight-owner checker returns Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade --- ...-10-11-v0.8-post-flip-checker-closure.json | 481 ++++++++++++++++++ .../2026-10-11-v0.8-source-acceptance.md | 23 + ...H-WP-0004-section-11-layer-declarations.md | 109 +++- 3 files changed, 599 insertions(+), 14 deletions(-) create mode 100644 docs/evidence/2026-10-11-v0.8-post-flip-checker-closure.json create mode 100644 docs/evidence/2026-10-11-v0.8-source-acceptance.md diff --git a/docs/evidence/2026-10-11-v0.8-post-flip-checker-closure.json b/docs/evidence/2026-10-11-v0.8-post-flip-checker-closure.json new file mode 100644 index 0000000..fc8f2e1 --- /dev/null +++ b/docs/evidence/2026-10-11-v0.8-post-flip-checker-closure.json @@ -0,0 +1,481 @@ +{ + "date": "2026-10-11", + "kind": "source-migration-closure", + "task": "GH-WP-0004-T11", + "accepted_canonical_sha256": "3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b", + "applied_manifest_files_verified": [ + { + "repo": "ops-warden", + "path": "scripts/check_layer_conformance.py", + "sha256": "7262fae9fae7ed454c0765cc6859e83a74e59ef6eade849991e0b8ab9c66757b" + }, + { + "repo": "ops-warden", + "path": "tests/test_layer_conformance.py", + "sha256": "93e3a8805460c4a6a4fd78734cf4dd85947a46e23d16a0d6898a43e8ec39275d" + }, + { + "repo": "ops-warden", + "path": "INTENT.md", + "sha256": "3e9382fefa52ee0970dfac133cc799656e5034760b26dccc1bf9bab65fc538d9" + }, + { + "repo": "secrets-engine", + "path": "scripts/check_layer_conformance.py", + "sha256": "990ef566b336509cf5c7cfe75c00ce37d091396a27e1e78b7ce77aad920e8de5" + }, + { + "repo": "secrets-engine", + "path": "tests/test_layer_conformance.py", + "sha256": "c91f69d27189d012fbf2622e92d5933793aed79647db9e14be7885f2261ecbd0" + }, + { + "repo": "secrets-engine", + "path": "INTENT.md", + "sha256": "188dc6d99ca9a441e7389a3715ba48275ab6e8745deaff686bd27d2aac34d678" + }, + { + "repo": "tenant-engine", + "path": "scripts/check_layer_conformance.py", + "sha256": "be73ae48b44fcf09115d6a3897bbd69f71bcebc54f2dce14afb307e3c1e67b5f" + }, + { + "repo": "tenant-engine", + "path": "tests/test_layer_conformance.py", + "sha256": "19a6fd4895a4efaebd1825c189fdb1274a3b5c0d75d056e6a0f24d9e4d715ab2" + }, + { + "repo": "tenant-engine", + "path": "INTENT.md", + "sha256": "c2deaef01f7492ca1b39f52e36bf703f6a55b04158b2888b7befae73452ce285" + }, + { + "repo": "ops-warden", + "path": "registry/routing/catalog.yaml", + "sha256": "09ee40df21b0ad8cad420be4613afcb1731967f68128631a94f9b96f3f31b318" + }, + { + "repo": "ops-warden", + "path": "tests/test_routing.py", + "sha256": "43998fccf67b1f0d1a6c8bde1a4768a32f8418fb72a8eda5bf321dd96c097d35" + }, + { + "repo": "ops-warden", + "path": "wiki/playbooks/netkingdom-layer-declaration.md", + "sha256": "6a409a1c474ce8759b01cf5a62e5b95bba297e167a05fd8f8b616abdf6414306" + }, + { + "repo": "ops-warden", + "path": "docs/evidence/2026-10-11-security-layer-v08-migration.json", + "sha256": "802a3976dec7645274a2736d68d198870a199338dca7f4b88b2acae51ec5470a" + }, + { + "repo": "secrets-engine", + "path": "docs/evidence/2026-10-11-security-layer-v08-migration.json", + "sha256": "b7f535b47edb258a7e1b2876bf82b9796934235b094255209ecfe78b58fb530e" + }, + { + "repo": "tenant-engine", + "path": "docs/evidence/2026-10-11-security-layer-v08-migration.json", + "sha256": "193d0473884bc956b9434a593efeb93fa54ee8daef6129ddbd4261e00b974f80" + }, + { + "repo": "kings-guard", + "path": "scripts/check_layer_conformance.py", + "sha256": "4f9a3ebe626b06528b14f84ecf3c4511fbc7417a9e4ce1086ba7e2c82adcab72" + }, + { + "repo": "kings-guard", + "path": "tests/test_layer_conformance.py", + "sha256": "132aa85a83be2a13ae161ea486f08badcb70091f9f6939a6d6bc74408d4d7278" + }, + { + "repo": "kings-guard", + "path": "tests/test_layer_v08_convergence.py", + "sha256": "276db6a9a5adb99178a5c33f4ec49937104204f1f70c428f053214902a393b52" + }, + { + "repo": "kings-guard", + "path": "docs/conformance/2026-10-11-layer-v08-migration.md", + "sha256": "33c7c6028d13ddd8ee88398c9e5bf7b5192b4e07a4be03adda9d3495d8f24a94" + }, + { + "repo": "user-engine", + "path": "scripts/check_layer_conformance.py", + "sha256": "4f6c8739610a57fe55148c19535832087d9259bfc264a11eca649d438e8a191d" + }, + { + "repo": "user-engine", + "path": "tests/test_layer_v08_convergence.py", + "sha256": "55699b1090411f582f0550617ce6a4e975c6e453c7cbca824b4bb3e86a25d8e4" + }, + { + "repo": "user-engine", + "path": "docs/conformance/2026-10-11-layer-v08-migration.md", + "sha256": "c2481f0d4aece441f8f3d0cff3e75de0afcbf3299797e69539db349e451a6fb2" + }, + { + "repo": "zone-engine", + "path": "tools/check_layer_conformance.py", + "sha256": "7769a4a40ab13e373f2171213494b04732cd53d988a579e4f1e7f0c1c441a9e5" + }, + { + "repo": "zone-engine", + "path": "tests/test_layer_v08_convergence.py", + "sha256": "24fd7071afb6019eba86e617c7d7a77f01b3bfac9f7caf0221ee5c9bb5cd071f" + }, + { + "repo": "zone-engine", + "path": "docs/conformance/2026-10-11-layer-v08-migration.md", + "sha256": "ea4829af91892c02f34aa854c2d9f78ebe8742222f5f138e9952c8728a660ba6" + }, + { + "repo": "maturity-engine", + "path": "scripts/check_layer_conformance.py", + "sha256": "1cd1ae02ab94476c6dc888ea7e6159fc5652033947fff4b560114bb4ad4500f7" + }, + { + "repo": "maturity-engine", + "path": "tests/test_layer_conformance.py", + "sha256": "73b0f92fa7dd091da88767cd004acd5a605009ac40073362e2dad0fcccb000ee" + }, + { + "repo": "maturity-engine", + "path": "tests/test_layer_v08_convergence.py", + "sha256": "1f1c549b1eb3a9ceba1d56dd24760d03ceeec553126d57c04308785062fdce55" + }, + { + "repo": "maturity-engine", + "path": "docs/conformance/2026-10-11-layer-v08-migration.md", + "sha256": "075c11dca2932fcaa3c6289b8e51a5bea1dd970d0e734ffeee8c72b765990906" + }, + { + "repo": "gate-house", + "path": "docs/evidence/2026-10-11-v0.8-source-acceptance.md", + "sha256": "093368d29503f0a202b74543eb7f5ea35a1782048b24078069b678ab0c96b697" + }, + { + "repo": "gate-house", + "path": "workplans/GH-WP-0004-section-11-layer-declarations.md", + "sha256": "8aecfe8c4549c77c933356da2f123854561d34f89cc2d21c90be981bcdb51939" + }, + { + "repo": "whitehat-security", + "path": "INTENT.md", + "sha256": "acef2293815fb9bded28a60ee1bc47c196bb38541a28265d895d69ae773731ba" + }, + { + "repo": "whitehat-security", + "path": "SCOPE.md", + "sha256": "394dc1d432d4dd3eec735289ef83a8beedeb3afce667f5a8c3a052902a1e26ba" + }, + { + "repo": "whitehat-security", + "path": "docs/evidence/2026-10-11-layer-declaration-migration.md", + "sha256": "3b167d69ad1d8d0a840710660650822a7e9e0e10492c65c55f203e5cfa9470c7" + }, + { + "repo": "whitehat-security", + "path": "docs/evidence/2026-10-11-layer-declaration-tests.log", + "sha256": "dc3f3fd678a8b276d181c52354ae51eb866aa25f0d5c169d48036c16dfc6c6a3" + }, + { + "repo": "whitehat-security", + "path": "tests/test_layer_declaration.py", + "sha256": "520e6b8f64bcbc57f53f69969685abab734ac40f63c3fb6f249ce1a29ea56c56" + }, + { + "repo": "whitehat-security", + "path": "workplans/ADHOC-2026-10-11.md", + "sha256": "3018ea53248da28d8c93a1b94c035f947ae53ebf629ab299b138b09fa8c39dbb" + }, + { + "repo": "access-engine", + "path": "internal/layer/conformance.go", + "sha256": "1259b683f39ee82ec7d7c500433693dd765b960e90dd0a7b861efcb512a474b0" + }, + { + "repo": "access-engine", + "path": "internal/layer/conformance_test.go", + "sha256": "9f8545ddf1970a5ddf83513d2ce1f7a7b347999770f31f862315114ecccd8b4f" + }, + { + "repo": "access-engine", + "path": "tools/check_layer_conformance.go", + "sha256": "ab3adadfc5e4a0ba8a53a1b47b62c4b10394bff7186eea200f3b42fa7a2ca303" + } + ], + "applied_python_checks": [ + { + "repo": "kings-guard", + "receipt_path": "/home/worsch/the-custodian/docs/evidence/2026-10-10-security-consolidation/applied-v08-checks/kings-guard.json", + "receipt_sha256": "436da7feba6cf61c34c982735e8a3b6c71ff3076b1f0af93bdd5cc907d3f2eb8", + "results": [ + { + "argv": [ + "/home/worsch/kings-guard/.venv/bin/python", + "scripts/check_layer_conformance.py" + ], + "exit_code": 0, + "stdout": "checking against: net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted-1 sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)\nscope: kings-guard only (\u00a74 row, Staff): INTENT.md frontmatter, layer.yaml, src/kings_guard, repository tree for credential files\nNOTE (A12 r3 provenance, reported not failed): layer.yaml: 'non_tooling_clients[0].note' cites v0.5 in prose\nNOTE (A12 r3 provenance, reported not failed): layer.yaml: 'unowned_capabilities[0].owner_status' cites v0.6 in prose\nNOTE (A12 r3 provenance, reported not failed): layer.yaml: 'unowned_capabilities[2].blocked_on' cites v0.6 in prose\nOK: no direct Tooling client in src/kings_guard; no standing credential (\u00a75, \u00a711, \u00a73.4 rule 1); declaration forms agree; no standard or companion version in either form; validated against net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted-1 sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b); scope: kings-guard only (\u00a74 row, Staff): INTENT.md frontmatter, layer.yaml, src/kings_guard, repository tree for credential files\n", + "stderr": "" + }, + { + "argv": [ + "/home/worsch/kings-guard/.venv/bin/python", + "-m", + "pytest", + "-q", + "-p", + "no:cacheprovider", + "tests/test_layer_conformance.py", + "tests/test_layer_v08_convergence.py" + ], + "exit_code": 0, + "stdout": "..................................... [100%]\n37 passed in 1.24s\n", + "stderr": "" + } + ] + }, + { + "repo": "maturity-engine", + "receipt_path": "/home/worsch/the-custodian/docs/evidence/2026-10-10-security-consolidation/applied-v08-checks/maturity-engine.json", + "receipt_sha256": "33927b179b44699a8add2ea6db179ea8481daa0c3fcad9c7fa1684583686f000", + "results": [ + { + "argv": [ + "python3", + "scripts/check_layer_conformance.py" + ], + "exit_code": 0, + "stdout": "check_layer_conformance: validated against net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted-1 sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b); scope: INTENT.md frontmatter, layer.yaml, imports under src/maturity_engine\nOK: Engine/PIP declaration holds; no catalogued Tooling client in src/maturity_engine; validated against net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted-1 sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b); scope: INTENT.md frontmatter, layer.yaml, imports under src/maturity_engine\n", + "stderr": "" + }, + { + "argv": [ + "python3", + "-m", + "pytest", + "-q", + "-p", + "no:cacheprovider", + "tests/test_layer_conformance.py", + "tests/test_layer_v08_convergence.py" + ], + "exit_code": 0, + "stdout": "................................ [100%]\n32 passed in 0.57s\n", + "stderr": "" + } + ] + }, + { + "repo": "ops-warden", + "receipt_path": "/home/worsch/the-custodian/docs/evidence/2026-10-10-security-consolidation/applied-v08-checks/ops-warden.json", + "receipt_sha256": "b3be5d60cc314056046ad6c4737f71a816f6087f5dcc0b4e99928f98c9483022", + "results": [ + { + "argv": [ + "/home/worsch/ops-warden/.venv/bin/python", + "scripts/check_layer_conformance.py" + ], + "exit_code": 0, + "stdout": "validated against: net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted; sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)\nscope: single repository ops-warden (catalogued in \u00a74); INTENT.md frontmatter, layer.yaml, src/warden/**/*.py\nPASS \u2014 4 module(s) with Tooling contact, all declared; validated against net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted; sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)\n", + "stderr": "" + }, + { + "argv": [ + "/home/worsch/ops-warden/.venv/bin/python", + "-m", + "pytest", + "-q", + "-p", + "no:cacheprovider", + "tests/test_layer_conformance.py" + ], + "exit_code": 0, + "stdout": "............................... [100%]\n31 passed in 0.96s\n", + "stderr": "" + } + ] + }, + { + "repo": "secrets-engine", + "receipt_path": "/home/worsch/the-custodian/docs/evidence/2026-10-10-security-consolidation/applied-v08-checks/secrets-engine.json", + "receipt_sha256": "dbed49ecc0802558894c7a77752e4506f8fa72eea51984a0450b3231a4563678", + "results": [ + { + "argv": [ + "/home/worsch/secrets-engine/.venv/bin/python", + "scripts/check_layer_conformance.py" + ], + "exit_code": 0, + "stdout": "validated against: net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted; sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)\nscope: single repository secrets-engine (catalogued in \u00a74); declaration = INTENT.md frontmatter + layer.yaml (every key and value); source = src/secrets_engine/**/*.py; not reached by A12: pep-stance.yaml, evidence-classification.yaml\nPASS \u2014 Engine/Lifecycle declaration present, no decision surface, 1 OpenBao adapter module(s) owned; validated against net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted; sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b).\n", + "stderr": "" + }, + { + "argv": [ + "/home/worsch/secrets-engine/.venv/bin/python", + "-m", + "pytest", + "-q", + "-p", + "no:cacheprovider", + "tests/test_layer_conformance.py" + ], + "exit_code": 0, + "stdout": "........................................ [100%]\n", + "stderr": "" + } + ] + }, + { + "repo": "tenant-engine", + "receipt_path": "/home/worsch/the-custodian/docs/evidence/2026-10-10-security-consolidation/applied-v08-checks/tenant-engine.json", + "receipt_sha256": "e7bb87ba31f89eee8257916a4cb6adc5ce11414b35969d88683dcdc1ade83922", + "results": [ + { + "argv": [ + "/home/worsch/tenant-engine/.venv/bin/python", + "scripts/check_layer_conformance.py" + ], + "exit_code": 0, + "stdout": "checking against: net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted; sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)\nscope: single repository tenant-engine (catalogued in \u00a74); declaration = INTENT.md frontmatter + layer.yaml (every key and value); tooling scan = src/tenant_engine/**/*.py; not reached: pep-stance.yaml, pip-claims.yaml, comments, schema_version\nOK: Engine/PIP declaration matches INTENT.md; no Tooling client in src/tenant_engine; no version in the declaration; validated against net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted; sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)\n", + "stderr": "" + }, + { + "argv": [ + "/home/worsch/tenant-engine/.venv/bin/python", + "-m", + "pytest", + "-q", + "-p", + "no:cacheprovider", + "tests/test_layer_conformance.py" + ], + "exit_code": 0, + "stdout": "................ [100%]\n16 passed in 0.82s\n", + "stderr": "" + } + ] + }, + { + "repo": "user-engine", + "receipt_path": "/home/worsch/the-custodian/docs/evidence/2026-10-10-security-consolidation/applied-v08-checks/user-engine.json", + "receipt_sha256": "110182a2d4b39cfd57b80471d0886ee69e5f6044ca2c8edc7ea3f847ba13bf68", + "results": [ + { + "argv": [ + "/home/worsch/user-engine/.venv/bin/python", + "scripts/check_layer_conformance.py" + ], + "exit_code": 0, + "stdout": "OK: no catalogued Tooling client in src/user_engine (Engine/PIP, \u00a711); checked against net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted-1 sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b); scope: declaration: INTENT.md frontmatter + layer.yaml (all keys and values); imports: src/user_engine/**/*.py\n", + "stderr": "" + }, + { + "argv": [ + "/home/worsch/user-engine/.venv/bin/python", + "-m", + "pytest", + "-q", + "-p", + "no:cacheprovider", + "tests/test_layer_conformance.py", + "tests/test_layer_v08_convergence.py" + ], + "exit_code": 1, + "stdout": "", + "stderr": "/home/worsch/user-engine/.venv/bin/python: No module named pytest\n" + } + ] + }, + { + "repo": "zone-engine", + "receipt_path": "/home/worsch/the-custodian/docs/evidence/2026-10-10-security-consolidation/applied-v08-checks/zone-engine.json", + "receipt_sha256": "9425fbd2e63e8994025840d6c4d51043d0e79fa7f5e2382ceef2b75c804ac9a6", + "results": [ + { + "argv": [ + "python3", + "tools/check_layer_conformance.py" + ], + "exit_code": 0, + "stdout": "checker validated against: net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted-1 sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)\nscope: INTENT.md frontmatter, layer.yaml (A12 across all keys and values), tools/**/*.py\nOK: Engine/PIP declaration agrees with INTENT.md and carries no standard version; no Tooling client or decision surface in tools; validated against net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted-1 sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)\n", + "stderr": "" + }, + { + "argv": [ + "python3", + "-m", + "pytest", + "-q", + "-p", + "no:cacheprovider", + "tests/test_layer_conformance.py", + "tests/test_layer_v08_convergence.py" + ], + "exit_code": 0, + "stdout": "................................. [100%]\n33 passed in 0.44s\n", + "stderr": "" + } + ] + } + ], + "corrected_and_complementary_actual_checks": [ + { + "repo": "user-engine", + "argv": [ + "python3", + "-m", + "pytest", + "-q", + "-p", + "no:cacheprovider", + "tests/test_layer_conformance.py", + "tests/test_layer_v08_convergence.py" + ], + "exit_code": 0, + "stdout": "................................. [100%]\n33 passed in 2.15s\n", + "stderr": "" + }, + { + "repo": "whitehat-security", + "argv": [ + "python3", + "-m", + "pytest", + "-q", + "-p", + "no:cacheprovider", + "tests/test_layer_declaration.py" + ], + "exit_code": 0, + "stdout": "... [100%]\n3 passed in 0.01s\n", + "stderr": "" + }, + { + "repo": "access-engine", + "argv": [ + "go", + "test", + "./internal/layer" + ], + "exit_code": 0, + "stdout": "ok \tgithub.com/netkingdom/access-engine/internal/layer\t(cached)\n", + "stderr": "" + }, + { + "repo": "access-engine", + "argv": [ + "go", + "run", + "./tools/check_layer_conformance.go" + ], + "exit_code": 0, + "stdout": "Validated against: net-kingdom/canon/standards/security-layer-model_v0.8.md (sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)\nScope: this repository only \u2014 access-engine/INTENT.md frontmatter (the \u00a711 declaration), optional derived layer.yaml/layer.yml declarations, the files INTENT names, and production Go sources under cmd/, internal/, pkg/. Stance, claims and classification maps are not read.\nPASS \u2014 Engine/PDP declaration parses; no standard or companion version anywhere in it; no Tooling client in the tree.\n", + "stderr": "" + } + ], + "initial_setup_failure": "User owner venv lacks pytest; actual system python with PYTHONPATH=src passed33. Prior failedreceipt preserved as setupfailure, never counted as pass.", + "scope": "Eight owner checkers reference accepted v0.8 and implement shared declaration-pin/provenance semantics; Whitehat conformance state relocated. No whole-estate security, native capabilities or served PolicyNexus release claimed." +} diff --git a/docs/evidence/2026-10-11-v0.8-source-acceptance.md b/docs/evidence/2026-10-11-v0.8-source-acceptance.md new file mode 100644 index 0000000..87d8506 --- /dev/null +++ b/docs/evidence/2026-10-11-v0.8-source-acceptance.md @@ -0,0 +1,23 @@ +# Gate House publisher-acceptance recording — 2026-10-11 + +This is a recorder receipt of the confirmed human disposition and NetKingdom +source acceptance, not a new doctrine ruling or owner approval. + +- Native memo: `infd-20261010-security-layer-v08`, version 2. +- Approved source SHA256: `103a635f19ab9fe53094d69c3eeebcccd8e87ac9588846167e7e204a7c6de167`. +- Approval: `8432d0dc-adc0-42d0-9a5b-6b71ff492e15`. +- Disposition: `disp-43e051e9-b12f-4c34-b26e-40b85a96c2e8`, accept, confirmed and non-stale. +- Acceptance timestamp: 2026-10-10T23:23:53Z. +- Native evidence: `the-custodian/docs/evidence/2026-10-10-security-consolidation/human-acceptance-receipts.json`. +- Publisher record: `net-kingdom/docs/security-layer-v0.8-acceptance.md`. +- Accepted artifact SHA256: `3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b`. + +Normative source remains the approved cut; acceptance metadata and the §14 +publication notice are the only canonical additions. The derived companion +explicitly binds that canonical digest and does not acquire independent +normative authority. GH-WP-0004-T10 tracks this source acceptance handoff. +PolicyNexus site serving, runtime capabilities and native security acceptance +are not inferred from a source status flip. T11 tracks eight actual checker +migrations plus WhitehatSecurity's relocation of conformance_state to evidence; +its scope does not add a site-serving gate. T06's §3.4 doctrine question remains +open outside the §11 acceptance hold. diff --git a/workplans/GH-WP-0004-section-11-layer-declarations.md b/workplans/GH-WP-0004-section-11-layer-declarations.md index cab7385..82f0c03 100644 --- a/workplans/GH-WP-0004-section-11-layer-declarations.md +++ b/workplans/GH-WP-0004-section-11-layer-declarations.md @@ -4,13 +4,13 @@ type: workplan title: "§11 layer declarations — amendment set and estate closure" domain: infotech repo: gate-house -status: blocked +status: active flavor: implementation origin: GH-IN-0003 owner: codex topic_slug: infotech created: "2026-09-21" -updated: "2026-10-05" +updated: "2026-10-11" state_hub_workstream_id: "59481e51-2792-5f2c-99c8-2732a0561939" --- @@ -109,7 +109,7 @@ priority: low state_hub_task_id: "8dd32a14-35d9-55c3-adfa-d9c728b550b1" ``` -### T06 — Ask `informed-decision` whether it should become a §4 catalog row +### T06 — Resolve the Gate House §3.4 doctrine question, then disposition the requested §4 row Asked, not enrolled. Its correction from `surface` to `Staff`/`pep-shaped` is its own and is not a condition of this task. @@ -129,11 +129,23 @@ INFD-WP-0005 doctrine check on frictionless decision intake) is about memo admis `decisions/drafts/GH-DEC-2026-023-frictionless-decision-intake.md`). No other `informed-decision` message delivers the gate. The wait stands. +2026-10-10 (security consolidation, Gate House owner recording): the external answer +is already complete. `informed-decision/INTENT.md` (Layer declaration, unresolved question) +and `informed-decision/docs/section-4-catalog-row.md` §§1, 3, 5 state both the affirmative +request and its evidence obligations. `GH-DEC-2026-021`, “What this does not rule”, +explicitly assigns the remaining answer to §3.4 doctrine: amend that definition or state +a carried tension in the standard’s voice. Gate House owns that doctrine; requiring +`informed-decision` to resolve it was a stale ownership assignment. + +Retargeted to Gate House preparation and disposition of the §3.4 question, then handoff +of the requested §4 row to net-kingdom. This records no doctrine ruling, human decision, +row publication or emission guarantee. `INFD-IN-0007` and the missing row stay open. +The question remains outside the §11 acceptance hold (`GH-DEC-2026-019` §5 and +`GH-DEC-2026-021`); T10 must not acquire it as a new flip condition. + ```task id: GH-WP-0004-T06 -status: wait -blocked_on: message-from:informed-decision -blocking_reason: "informed-decision answered yes; its section-4 row is coupled to INFD-IN-0007, still open with no deadline (reply 2026-09-27; rechecked 2026-10-03)." +status: todo priority: medium state_hub_task_id: "62ac1f55-d3fc-59bd-84a5-8baec5de6bac" ``` @@ -200,12 +212,31 @@ return for `access-engine` and `ops-warden`. Still outstanding and theirs to giv `approval-engine`, `kings-guard`, `railiance-master` (no r2/r3 return in the inbox). Wait re-qualified from `audit-core` to the outstanding members. +2026-10-10 (security consolidation): all three missing owners returned fresh technical +reviews of **A11 r2 / A12 r3**, exact source +`docs/amendments/v0.8-section-11-declaration-amendments.md`, SHA-256 +`9b454b83c9aeed08ba13dba4d812f5ae6b4293ced9e43088d64cc3cc00b1459d`. +The Gate House worker read the exact text and each distinct owner return, confirmed +its INTENT basis, own work item, approval disposition and review scope. Each resolves +the owner’s earlier revision-specific question; no remaining technical objection is +claimed for these two amendments. This discharges T09’s missing-return condition. + +| Owner source | Owner work item | Review SHA-256 | +| --- | --- | --- | +| [kings-guard technical return](../../kings-guard/docs/reviews/2026-10-10-a11-r2-a12-r3.md) | `KG-WP-ADHOC-2026-10-10-T01` | `eb0bf102653707f5c80f4594df1427ef70f65ed3686abc824418fa19ab9983bb` | +| [approval-engine technical return](../../approval-engine/docs/reviews/2026-10-10-gate-house-a11-r2-a12-r3-owner-review.md) | `APPROVAL-WP-ADHOC-2026-10-10-T01` | `978527d58222bd14fb20cbe963eb87cad49dfd4a8b2dfa420ee102b5ffb4d002` | +| [railiance-master technical return](../../railiance-master/docs/reviews/2026-10-10-gate-house-a11-r2-a12-r3-owner-review.md) | `RMASTER-WP-ADHOC-2026-10-10-T01` | `ee3739febdd9346537ff9892dd0bf2f086544a42e3e65275f5342edc8f23ef84` | + +These are owner technical reviews under the accepted Custodian +`canon/standards/delegated-owner-review_v0.1.md`, not founder decisions or publisher +acceptance. Earlier recorded operator dispositions remain history; these returns are +not substituted for them. T10 still requires net-kingdom publication/acceptance; T11 +still waits for the actual flip. Accepted v0.7 remains the statute in force. + ```task id: GH-WP-0004-T09 -status: wait -blocked_on: message-from:kings-guard +status: done priority: high -blocking_reason: "A11 r2 / A12 r3 returns outstanding from kings-guard, approval-engine and railiance-master; all others returned approved." state_hub_task_id: "ea3e5868-74c8-5893-b514-f60abdaaf42f" ``` @@ -222,12 +253,32 @@ returns and on T12 (audit-core's findings are against the cut), then on `net-kin 2026-10-05: T12's disposition is recorded (`GH-DEC-2026-024`). T09's remaining returns and the net-kingdom flip remain. v0.8 is not flipped; the hold under `GH-DEC-2026-019` stands. +2026-10-10: T09’s exact-revision technical returns are complete and T12’s existing +ruling remains recorded. The next action belongs to net-kingdom: assemble/verify the +amended cut and provide its publication/acceptance record. Gate House records neither +the flip nor a human ratification here; the hold is not discharged by technical returns +alone. T06’s separate §3.4 question remains outside this §11 hold. + +2026-10-11: confirmed native human memo `infd-20261010-security-layer-v08`, +version 2, accepts exact proposed source SHA256 +`103a635f19ab9fe53094d69c3eeebcccd8e87ac9588846167e7e204a7c6de167`. +Approval `8432d0dc-adc0-42d0-9a5b-6b71ff492e15` and disposition +`disp-43e051e9-b12f-4c34-b26e-40b85a96c2e8` are confirmed, non-stale, +accepted at 2026-10-10T23:23:53Z. NetKingdom records source publication +acceptance in `docs/security-layer-v0.8-acceptance.md`; its accepted artifact +SHA256 is `3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b`. +Only acceptance frontmatter and §14 notice were added to the approved normative +cut. T09, T07/T12 and T08 discharge the three GH-DEC-2026-019 closing conditions; +T06 remains separate. This completes the source acceptance handoff tracked by +T10. It grants no live deployment or credential authority. PolicyNexus serving +release is separate and is not T10's publisher-acceptance condition. The +[recording receipt](../docs/evidence/2026-10-11-v0.8-source-acceptance.md) +distinguishes source acceptance from serving publication. + ```task id: GH-WP-0004-T10 -status: wait +status: done depends_on: [GH-WP-0004-T09, GH-WP-0004-T12] -blocked_on: message-from:net-kingdom -blocking_reason: "T12 disposition is recorded (GH-DEC-2026-024). net-kingdom flips v0.8 once T09 returns; the hold under GH-DEC-2026-019 stands. v0.8 is not flipped." priority: medium state_hub_task_id: "34d0582b-9b7e-5dcf-ac1e-0257312b8b7b" ``` @@ -242,11 +293,41 @@ reason in writing: `kings-guard`, `user-engine`, `zone-engine`, `secrets-engine` all eight. `whitehat-security`'s move of `conformance_state` out of its declaration is tracked here with the same deadline. +2026-10-11: the accepted source unblocks post-flip migration. Eight checker +changes and the WhitehatSecurity declaration-state relocation are prepared +in their owner sources. T11 stays progress until their applied source changes, +reference pin/provenance semantics and actual owner check outputs are recorded. +PolicyNexus serving release is a separate publication delivery gate, not an +additional T11 checker condition. No migration is counted from staging alone. + +2026-10-11 (applied-source verification): all eight named checkers now +reference accepted v0.8, exact canonical SHA256 +`3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b`, +and their actual owner runs record scope. All 40 applied migration paths match +the reviewed manifest hashes. Python owner checker/test receipts pass for +KingsGuard, UserEngine, ZoneEngine, SecretsEngine, MaturityEngine, OpsWarden +and TenantEngine. UserEngine's first test attempt lacked pytest in its owner +venv; the corrected actual command with `PYTHONPATH=src` passes 33 tests. +AccessEngine's actual Go layer package tests pass and its executable detector +reports accepted v0.8, exact digest, scope and PASS. The shared reference +semantics retain pin rejection, authoritative INTENT, derived-sidecar +provenance and disagreement findings; historical negative version fixtures +remain intentional detector inputs. WhitehatSecurity's applied declaration +contains no conformance_state; its dated evidence preserves blocked-clean, +SCOPE links that evidence and its three actual declaration tests pass. + +The [self-contained applied-source receipt](../docs/evidence/2026-10-11-v0.8-post-flip-checker-closure.json) +retains actual commands/results, setup correction and all applied file hashes. +This discharges T11's post-flip migration condition. It establishes the stated +source checks, not whole-estate conformance, native capability acceptance, +complete audit emission or a served PolicyNexus publication. T06 remains todo +under Gate House doctrine; GH-WP-0004 remains active until that separate task +has a real disposition. + ```task id: GH-WP-0004-T11 -status: wait +status: done depends_on: [GH-WP-0004-T10] -blocking_reason: "Post-flip condition: the eight checkers re-point to accepted v0.8." priority: medium state_hub_task_id: "1643517b-96e5-5cad-bbe0-0207189e352c" ```