Close verified v0.8 source flip and eight-owner checker returns

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 02:21:40 +02:00
parent 320d254c35
commit 8e7f012326
3 changed files with 599 additions and 14 deletions

View file

@ -0,0 +1,481 @@
{
"date": "2026-10-11",
"kind": "source-migration-closure",
"task": "GH-WP-0004-T11",
"accepted_canonical_sha256": "3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b",
"applied_manifest_files_verified": [
{
"repo": "ops-warden",
"path": "scripts/check_layer_conformance.py",
"sha256": "7262fae9fae7ed454c0765cc6859e83a74e59ef6eade849991e0b8ab9c66757b"
},
{
"repo": "ops-warden",
"path": "tests/test_layer_conformance.py",
"sha256": "93e3a8805460c4a6a4fd78734cf4dd85947a46e23d16a0d6898a43e8ec39275d"
},
{
"repo": "ops-warden",
"path": "INTENT.md",
"sha256": "3e9382fefa52ee0970dfac133cc799656e5034760b26dccc1bf9bab65fc538d9"
},
{
"repo": "secrets-engine",
"path": "scripts/check_layer_conformance.py",
"sha256": "990ef566b336509cf5c7cfe75c00ce37d091396a27e1e78b7ce77aad920e8de5"
},
{
"repo": "secrets-engine",
"path": "tests/test_layer_conformance.py",
"sha256": "c91f69d27189d012fbf2622e92d5933793aed79647db9e14be7885f2261ecbd0"
},
{
"repo": "secrets-engine",
"path": "INTENT.md",
"sha256": "188dc6d99ca9a441e7389a3715ba48275ab6e8745deaff686bd27d2aac34d678"
},
{
"repo": "tenant-engine",
"path": "scripts/check_layer_conformance.py",
"sha256": "be73ae48b44fcf09115d6a3897bbd69f71bcebc54f2dce14afb307e3c1e67b5f"
},
{
"repo": "tenant-engine",
"path": "tests/test_layer_conformance.py",
"sha256": "19a6fd4895a4efaebd1825c189fdb1274a3b5c0d75d056e6a0f24d9e4d715ab2"
},
{
"repo": "tenant-engine",
"path": "INTENT.md",
"sha256": "c2deaef01f7492ca1b39f52e36bf703f6a55b04158b2888b7befae73452ce285"
},
{
"repo": "ops-warden",
"path": "registry/routing/catalog.yaml",
"sha256": "09ee40df21b0ad8cad420be4613afcb1731967f68128631a94f9b96f3f31b318"
},
{
"repo": "ops-warden",
"path": "tests/test_routing.py",
"sha256": "43998fccf67b1f0d1a6c8bde1a4768a32f8418fb72a8eda5bf321dd96c097d35"
},
{
"repo": "ops-warden",
"path": "wiki/playbooks/netkingdom-layer-declaration.md",
"sha256": "6a409a1c474ce8759b01cf5a62e5b95bba297e167a05fd8f8b616abdf6414306"
},
{
"repo": "ops-warden",
"path": "docs/evidence/2026-10-11-security-layer-v08-migration.json",
"sha256": "802a3976dec7645274a2736d68d198870a199338dca7f4b88b2acae51ec5470a"
},
{
"repo": "secrets-engine",
"path": "docs/evidence/2026-10-11-security-layer-v08-migration.json",
"sha256": "b7f535b47edb258a7e1b2876bf82b9796934235b094255209ecfe78b58fb530e"
},
{
"repo": "tenant-engine",
"path": "docs/evidence/2026-10-11-security-layer-v08-migration.json",
"sha256": "193d0473884bc956b9434a593efeb93fa54ee8daef6129ddbd4261e00b974f80"
},
{
"repo": "kings-guard",
"path": "scripts/check_layer_conformance.py",
"sha256": "4f9a3ebe626b06528b14f84ecf3c4511fbc7417a9e4ce1086ba7e2c82adcab72"
},
{
"repo": "kings-guard",
"path": "tests/test_layer_conformance.py",
"sha256": "132aa85a83be2a13ae161ea486f08badcb70091f9f6939a6d6bc74408d4d7278"
},
{
"repo": "kings-guard",
"path": "tests/test_layer_v08_convergence.py",
"sha256": "276db6a9a5adb99178a5c33f4ec49937104204f1f70c428f053214902a393b52"
},
{
"repo": "kings-guard",
"path": "docs/conformance/2026-10-11-layer-v08-migration.md",
"sha256": "33c7c6028d13ddd8ee88398c9e5bf7b5192b4e07a4be03adda9d3495d8f24a94"
},
{
"repo": "user-engine",
"path": "scripts/check_layer_conformance.py",
"sha256": "4f6c8739610a57fe55148c19535832087d9259bfc264a11eca649d438e8a191d"
},
{
"repo": "user-engine",
"path": "tests/test_layer_v08_convergence.py",
"sha256": "55699b1090411f582f0550617ce6a4e975c6e453c7cbca824b4bb3e86a25d8e4"
},
{
"repo": "user-engine",
"path": "docs/conformance/2026-10-11-layer-v08-migration.md",
"sha256": "c2481f0d4aece441f8f3d0cff3e75de0afcbf3299797e69539db349e451a6fb2"
},
{
"repo": "zone-engine",
"path": "tools/check_layer_conformance.py",
"sha256": "7769a4a40ab13e373f2171213494b04732cd53d988a579e4f1e7f0c1c441a9e5"
},
{
"repo": "zone-engine",
"path": "tests/test_layer_v08_convergence.py",
"sha256": "24fd7071afb6019eba86e617c7d7a77f01b3bfac9f7caf0221ee5c9bb5cd071f"
},
{
"repo": "zone-engine",
"path": "docs/conformance/2026-10-11-layer-v08-migration.md",
"sha256": "ea4829af91892c02f34aa854c2d9f78ebe8742222f5f138e9952c8728a660ba6"
},
{
"repo": "maturity-engine",
"path": "scripts/check_layer_conformance.py",
"sha256": "1cd1ae02ab94476c6dc888ea7e6159fc5652033947fff4b560114bb4ad4500f7"
},
{
"repo": "maturity-engine",
"path": "tests/test_layer_conformance.py",
"sha256": "73b0f92fa7dd091da88767cd004acd5a605009ac40073362e2dad0fcccb000ee"
},
{
"repo": "maturity-engine",
"path": "tests/test_layer_v08_convergence.py",
"sha256": "1f1c549b1eb3a9ceba1d56dd24760d03ceeec553126d57c04308785062fdce55"
},
{
"repo": "maturity-engine",
"path": "docs/conformance/2026-10-11-layer-v08-migration.md",
"sha256": "075c11dca2932fcaa3c6289b8e51a5bea1dd970d0e734ffeee8c72b765990906"
},
{
"repo": "gate-house",
"path": "docs/evidence/2026-10-11-v0.8-source-acceptance.md",
"sha256": "093368d29503f0a202b74543eb7f5ea35a1782048b24078069b678ab0c96b697"
},
{
"repo": "gate-house",
"path": "workplans/GH-WP-0004-section-11-layer-declarations.md",
"sha256": "8aecfe8c4549c77c933356da2f123854561d34f89cc2d21c90be981bcdb51939"
},
{
"repo": "whitehat-security",
"path": "INTENT.md",
"sha256": "acef2293815fb9bded28a60ee1bc47c196bb38541a28265d895d69ae773731ba"
},
{
"repo": "whitehat-security",
"path": "SCOPE.md",
"sha256": "394dc1d432d4dd3eec735289ef83a8beedeb3afce667f5a8c3a052902a1e26ba"
},
{
"repo": "whitehat-security",
"path": "docs/evidence/2026-10-11-layer-declaration-migration.md",
"sha256": "3b167d69ad1d8d0a840710660650822a7e9e0e10492c65c55f203e5cfa9470c7"
},
{
"repo": "whitehat-security",
"path": "docs/evidence/2026-10-11-layer-declaration-tests.log",
"sha256": "dc3f3fd678a8b276d181c52354ae51eb866aa25f0d5c169d48036c16dfc6c6a3"
},
{
"repo": "whitehat-security",
"path": "tests/test_layer_declaration.py",
"sha256": "520e6b8f64bcbc57f53f69969685abab734ac40f63c3fb6f249ce1a29ea56c56"
},
{
"repo": "whitehat-security",
"path": "workplans/ADHOC-2026-10-11.md",
"sha256": "3018ea53248da28d8c93a1b94c035f947ae53ebf629ab299b138b09fa8c39dbb"
},
{
"repo": "access-engine",
"path": "internal/layer/conformance.go",
"sha256": "1259b683f39ee82ec7d7c500433693dd765b960e90dd0a7b861efcb512a474b0"
},
{
"repo": "access-engine",
"path": "internal/layer/conformance_test.go",
"sha256": "9f8545ddf1970a5ddf83513d2ce1f7a7b347999770f31f862315114ecccd8b4f"
},
{
"repo": "access-engine",
"path": "tools/check_layer_conformance.go",
"sha256": "ab3adadfc5e4a0ba8a53a1b47b62c4b10394bff7186eea200f3b42fa7a2ca303"
}
],
"applied_python_checks": [
{
"repo": "kings-guard",
"receipt_path": "/home/worsch/the-custodian/docs/evidence/2026-10-10-security-consolidation/applied-v08-checks/kings-guard.json",
"receipt_sha256": "436da7feba6cf61c34c982735e8a3b6c71ff3076b1f0af93bdd5cc907d3f2eb8",
"results": [
{
"argv": [
"/home/worsch/kings-guard/.venv/bin/python",
"scripts/check_layer_conformance.py"
],
"exit_code": 0,
"stdout": "checking against: net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted-1 sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)\nscope: kings-guard only (\u00a74 row, Staff): INTENT.md frontmatter, layer.yaml, src/kings_guard, repository tree for credential files\nNOTE (A12 r3 provenance, reported not failed): layer.yaml: 'non_tooling_clients[0].note' cites v0.5 in prose\nNOTE (A12 r3 provenance, reported not failed): layer.yaml: 'unowned_capabilities[0].owner_status' cites v0.6 in prose\nNOTE (A12 r3 provenance, reported not failed): layer.yaml: 'unowned_capabilities[2].blocked_on' cites v0.6 in prose\nOK: no direct Tooling client in src/kings_guard; no standing credential (\u00a75, \u00a711, \u00a73.4 rule 1); declaration forms agree; no standard or companion version in either form; validated against net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted-1 sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b); scope: kings-guard only (\u00a74 row, Staff): INTENT.md frontmatter, layer.yaml, src/kings_guard, repository tree for credential files\n",
"stderr": ""
},
{
"argv": [
"/home/worsch/kings-guard/.venv/bin/python",
"-m",
"pytest",
"-q",
"-p",
"no:cacheprovider",
"tests/test_layer_conformance.py",
"tests/test_layer_v08_convergence.py"
],
"exit_code": 0,
"stdout": "..................................... [100%]\n37 passed in 1.24s\n",
"stderr": ""
}
]
},
{
"repo": "maturity-engine",
"receipt_path": "/home/worsch/the-custodian/docs/evidence/2026-10-10-security-consolidation/applied-v08-checks/maturity-engine.json",
"receipt_sha256": "33927b179b44699a8add2ea6db179ea8481daa0c3fcad9c7fa1684583686f000",
"results": [
{
"argv": [
"python3",
"scripts/check_layer_conformance.py"
],
"exit_code": 0,
"stdout": "check_layer_conformance: validated against net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted-1 sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b); scope: INTENT.md frontmatter, layer.yaml, imports under src/maturity_engine\nOK: Engine/PIP declaration holds; no catalogued Tooling client in src/maturity_engine; validated against net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted-1 sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b); scope: INTENT.md frontmatter, layer.yaml, imports under src/maturity_engine\n",
"stderr": ""
},
{
"argv": [
"python3",
"-m",
"pytest",
"-q",
"-p",
"no:cacheprovider",
"tests/test_layer_conformance.py",
"tests/test_layer_v08_convergence.py"
],
"exit_code": 0,
"stdout": "................................ [100%]\n32 passed in 0.57s\n",
"stderr": ""
}
]
},
{
"repo": "ops-warden",
"receipt_path": "/home/worsch/the-custodian/docs/evidence/2026-10-10-security-consolidation/applied-v08-checks/ops-warden.json",
"receipt_sha256": "b3be5d60cc314056046ad6c4737f71a816f6087f5dcc0b4e99928f98c9483022",
"results": [
{
"argv": [
"/home/worsch/ops-warden/.venv/bin/python",
"scripts/check_layer_conformance.py"
],
"exit_code": 0,
"stdout": "validated against: net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted; sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)\nscope: single repository ops-warden (catalogued in \u00a74); INTENT.md frontmatter, layer.yaml, src/warden/**/*.py\nPASS \u2014 4 module(s) with Tooling contact, all declared; validated against net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted; sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)\n",
"stderr": ""
},
{
"argv": [
"/home/worsch/ops-warden/.venv/bin/python",
"-m",
"pytest",
"-q",
"-p",
"no:cacheprovider",
"tests/test_layer_conformance.py"
],
"exit_code": 0,
"stdout": "............................... [100%]\n31 passed in 0.96s\n",
"stderr": ""
}
]
},
{
"repo": "secrets-engine",
"receipt_path": "/home/worsch/the-custodian/docs/evidence/2026-10-10-security-consolidation/applied-v08-checks/secrets-engine.json",
"receipt_sha256": "dbed49ecc0802558894c7a77752e4506f8fa72eea51984a0450b3231a4563678",
"results": [
{
"argv": [
"/home/worsch/secrets-engine/.venv/bin/python",
"scripts/check_layer_conformance.py"
],
"exit_code": 0,
"stdout": "validated against: net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted; sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)\nscope: single repository secrets-engine (catalogued in \u00a74); declaration = INTENT.md frontmatter + layer.yaml (every key and value); source = src/secrets_engine/**/*.py; not reached by A12: pep-stance.yaml, evidence-classification.yaml\nPASS \u2014 Engine/Lifecycle declaration present, no decision surface, 1 OpenBao adapter module(s) owned; validated against net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted; sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b).\n",
"stderr": ""
},
{
"argv": [
"/home/worsch/secrets-engine/.venv/bin/python",
"-m",
"pytest",
"-q",
"-p",
"no:cacheprovider",
"tests/test_layer_conformance.py"
],
"exit_code": 0,
"stdout": "........................................ [100%]\n",
"stderr": ""
}
]
},
{
"repo": "tenant-engine",
"receipt_path": "/home/worsch/the-custodian/docs/evidence/2026-10-10-security-consolidation/applied-v08-checks/tenant-engine.json",
"receipt_sha256": "e7bb87ba31f89eee8257916a4cb6adc5ce11414b35969d88683dcdc1ade83922",
"results": [
{
"argv": [
"/home/worsch/tenant-engine/.venv/bin/python",
"scripts/check_layer_conformance.py"
],
"exit_code": 0,
"stdout": "checking against: net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted; sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)\nscope: single repository tenant-engine (catalogued in \u00a74); declaration = INTENT.md frontmatter + layer.yaml (every key and value); tooling scan = src/tenant_engine/**/*.py; not reached: pep-stance.yaml, pip-claims.yaml, comments, schema_version\nOK: Engine/PIP declaration matches INTENT.md; no Tooling client in src/tenant_engine; no version in the declaration; validated against net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted; sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)\n",
"stderr": ""
},
{
"argv": [
"/home/worsch/tenant-engine/.venv/bin/python",
"-m",
"pytest",
"-q",
"-p",
"no:cacheprovider",
"tests/test_layer_conformance.py"
],
"exit_code": 0,
"stdout": "................ [100%]\n16 passed in 0.82s\n",
"stderr": ""
}
]
},
{
"repo": "user-engine",
"receipt_path": "/home/worsch/the-custodian/docs/evidence/2026-10-10-security-consolidation/applied-v08-checks/user-engine.json",
"receipt_sha256": "110182a2d4b39cfd57b80471d0886ee69e5f6044ca2c8edc7ea3f847ba13bf68",
"results": [
{
"argv": [
"/home/worsch/user-engine/.venv/bin/python",
"scripts/check_layer_conformance.py"
],
"exit_code": 0,
"stdout": "OK: no catalogued Tooling client in src/user_engine (Engine/PIP, \u00a711); checked against net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted-1 sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b); scope: declaration: INTENT.md frontmatter + layer.yaml (all keys and values); imports: src/user_engine/**/*.py\n",
"stderr": ""
},
{
"argv": [
"/home/worsch/user-engine/.venv/bin/python",
"-m",
"pytest",
"-q",
"-p",
"no:cacheprovider",
"tests/test_layer_conformance.py",
"tests/test_layer_v08_convergence.py"
],
"exit_code": 1,
"stdout": "",
"stderr": "/home/worsch/user-engine/.venv/bin/python: No module named pytest\n"
}
]
},
{
"repo": "zone-engine",
"receipt_path": "/home/worsch/the-custodian/docs/evidence/2026-10-10-security-consolidation/applied-v08-checks/zone-engine.json",
"receipt_sha256": "9425fbd2e63e8994025840d6c4d51043d0e79fa7f5e2382ceef2b75c804ac9a6",
"results": [
{
"argv": [
"python3",
"tools/check_layer_conformance.py"
],
"exit_code": 0,
"stdout": "checker validated against: net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted-1 sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)\nscope: INTENT.md frontmatter, layer.yaml (A12 across all keys and values), tools/**/*.py\nOK: Engine/PIP declaration agrees with INTENT.md and carries no standard version; no Tooling client or decision surface in tools; validated against net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted-1 sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)\n",
"stderr": ""
},
{
"argv": [
"python3",
"-m",
"pytest",
"-q",
"-p",
"no:cacheprovider",
"tests/test_layer_conformance.py",
"tests/test_layer_v08_convergence.py"
],
"exit_code": 0,
"stdout": "................................. [100%]\n33 passed in 0.44s\n",
"stderr": ""
}
]
}
],
"corrected_and_complementary_actual_checks": [
{
"repo": "user-engine",
"argv": [
"python3",
"-m",
"pytest",
"-q",
"-p",
"no:cacheprovider",
"tests/test_layer_conformance.py",
"tests/test_layer_v08_convergence.py"
],
"exit_code": 0,
"stdout": "................................. [100%]\n33 passed in 2.15s\n",
"stderr": ""
},
{
"repo": "whitehat-security",
"argv": [
"python3",
"-m",
"pytest",
"-q",
"-p",
"no:cacheprovider",
"tests/test_layer_declaration.py"
],
"exit_code": 0,
"stdout": "... [100%]\n3 passed in 0.01s\n",
"stderr": ""
},
{
"repo": "access-engine",
"argv": [
"go",
"test",
"./internal/layer"
],
"exit_code": 0,
"stdout": "ok \tgithub.com/netkingdom/access-engine/internal/layer\t(cached)\n",
"stderr": ""
},
{
"repo": "access-engine",
"argv": [
"go",
"run",
"./tools/check_layer_conformance.go"
],
"exit_code": 0,
"stdout": "Validated against: net-kingdom/canon/standards/security-layer-model_v0.8.md (sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)\nScope: this repository only \u2014 access-engine/INTENT.md frontmatter (the \u00a711 declaration), optional derived layer.yaml/layer.yml declarations, the files INTENT names, and production Go sources under cmd/, internal/, pkg/. Stance, claims and classification maps are not read.\nPASS \u2014 Engine/PDP declaration parses; no standard or companion version anywhere in it; no Tooling client in the tree.\n",
"stderr": ""
}
],
"initial_setup_failure": "User owner venv lacks pytest; actual system python with PYTHONPATH=src passed33. Prior failedreceipt preserved as setupfailure, never counted as pass.",
"scope": "Eight owner checkers reference accepted v0.8 and implement shared declaration-pin/provenance semantics; Whitehat conformance state relocated. No whole-estate security, native capabilities or served PolicyNexus release claimed."
}

View file

@ -0,0 +1,23 @@
# Gate House publisher-acceptance recording — 2026-10-11
This is a recorder receipt of the confirmed human disposition and NetKingdom
source acceptance, not a new doctrine ruling or owner approval.
- Native memo: `infd-20261010-security-layer-v08`, version 2.
- Approved source SHA256: `103a635f19ab9fe53094d69c3eeebcccd8e87ac9588846167e7e204a7c6de167`.
- Approval: `8432d0dc-adc0-42d0-9a5b-6b71ff492e15`.
- Disposition: `disp-43e051e9-b12f-4c34-b26e-40b85a96c2e8`, accept, confirmed and non-stale.
- Acceptance timestamp: 2026-10-10T23:23:53Z.
- Native evidence: `the-custodian/docs/evidence/2026-10-10-security-consolidation/human-acceptance-receipts.json`.
- Publisher record: `net-kingdom/docs/security-layer-v0.8-acceptance.md`.
- Accepted artifact SHA256: `3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b`.
Normative source remains the approved cut; acceptance metadata and the §14
publication notice are the only canonical additions. The derived companion
explicitly binds that canonical digest and does not acquire independent
normative authority. GH-WP-0004-T10 tracks this source acceptance handoff.
PolicyNexus site serving, runtime capabilities and native security acceptance
are not inferred from a source status flip. T11 tracks eight actual checker
migrations plus WhitehatSecurity's relocation of conformance_state to evidence;
its scope does not add a site-serving gate. T06's §3.4 doctrine question remains
open outside the §11 acceptance hold.