Complete GH-WP-0001-T05 doctrine blueprint recut

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a05e30-2884-71b0-98d7-7edd16ae737b

CLAUDE.md

@@ -51,12 +51,12 @@ estate's layering rule:
    use cases `UC-01`…`UC-05`, success criteria. This is the "why".
 3. **`decisions/decisions.md`** — decision records. GH-DEC-2026-001 ratifies the layer
    model, the re-cut, and the access-engine reframing. Binding.
-4. **`ArchitectureBlueprint.md`** — **predates the re-cut and is only partly valid.** Its
+4. **`ArchitectureBlueprint.md`** — the current doctrine architecture: responsibility
-   component architecture (§10–11), policy evaluation order (§13), API surface (§26), and
+   boundaries, domain model, authority context, operating modes, posture and credential
-   storage model (§25) describe an engine and are withdrawn; ADR-003 and milestones M0, M3,
+   contracts, MCP doctrine, change dynamics, audit, invariants, and conformance. The
-   M4 have lapsed. Its domain model (§6), authority context (§7), operating modes (§14–15),
+   withdrawn v0.1 authority-plane design is mapped in
-   change dynamics (§20), MCP integration (§19), and security test program (§34) survive.
+   `history/2026-09-01-authority-plane-blueprint-retirement.md` and remains available at
-   Do not cite it without checking a section against INTENT first.
+   Git object `75ce372:ArchitectureBlueprint.md` for historical review only.
 5. **`README.md`** — public-facing summary. A derivative, not a source of truth.
 
 When these conflict: the decision record wins over everything, then the Canon, then INTENT,
@@ -75,7 +75,7 @@ repositories implement them. A document or proposal that violates one is wrong:
 - **Principal, actor, and runtime identity stay distinct** and are never collapsed into one
   field. Delegation attenuates and never widens.
 - **Posture may only restrict.** King's Guard (or any adaptive input) can reduce authority or
-  demand step-up; it can never manufacture privilege. See Blueprint §16.2 for the explicitly
+  demand step-up; it can never manufacture privilege. See Blueprint §8 for the explicitly
   forbidden pattern.
 - **Evaluation is monotonic toward restriction.** No stage after the authority ceiling may
   expand beyond it. (Evaluation itself is access-engine's; Gate House states the property.)
@@ -115,8 +115,9 @@ the file, commit, then sync. `SCOPE.md` is derived from `INTENT.md` — keep the
 ## Conventions
 
 - **Stable identifiers.** Invariants (`INV-nn`, `A-nn`), tests (`T-nn`), use cases (`UC-nn`),
-  ADRs (`ADR-nnn`), and milestones (`M0`–`M8`) are referenced across documents. Reuse the
+  and ADRs (`ADR-nnn`) are referenced across documents. Reuse the existing id when writing
-  existing id when writing about a concept; append rather than renumber.
+  about a concept; append rather than renumber. The v0.1 milestones (`M0`–`M8`) are
+  historical and must not be revived as Gate House implementation milestones.
 - **Canon prose is normative** — preserve MUST/SHOULD/MAY exactly when editing it.
 - **Domain vocabulary is fixed** by INTENT's Domain Vocabulary: principal, actor, runtime
   identity, mandate, delegation, authority ceiling, operating mode, posture, change dynamics
@@ -132,12 +133,12 @@ the file, commit, then sync. `SCOPE.md` is derived from `INTENT.md` — keep the
 
 ## Where new work goes
 
-- `README.md`, `INTENT.md`, and `ArchitectureBlueprint.md` live at the repo root, matching the
+- `README.md`, `INTENT.md`, and `ArchitectureBlueprint.md` live at the repo root. External
-  Blueprint's own reference layout (§32). External standards Gate House conforms to — the
+  standards Gate House conforms to — the Canon — live in `spec/`.
-  Canon — live in `spec/`.
+- ADRs → `docs/adr/`, with disposition recorded in Blueprint §17. ADR-003
-- ADRs → `docs/adr/`, from the Blueprint §40 backlog. ADR-003 (policy engine selection) has
+  (policy engine selection) has lapsed with the re-cut; ADR-001, ADR-002,
-  lapsed with the re-cut; ADR-001, ADR-002, ADR-006, ADR-009, ADR-010, ADR-013, ADR-014
+  ADR-006, ADR-009, ADR-010, ADR-013, ADR-014 remain meaningful as contract and
-  remain meaningful as contract and doctrine.
+  doctrine.
 - Decision records → `decisions/decisions.md`, via `rmgr decision create|resolve`. Never
   hand-write the YAML block; the tool mints identifiers and commits.
 - History and reference notes → `history/YYYY-MM-DD-<slug>.md`, matching the convention in
@@ -147,10 +148,10 @@ the file, commit, then sync. `SCOPE.md` is derived from `INTENT.md` — keep the
   2026-08-29 after seven versions; four repositories assented and each returned findings
   that changed it. Its working form is `net-kingdom/SECURITY-COMPANION.md` — read that
   first. For how to get something done in the estate, ask ops-warden, not this repo.
-- **No implementation layout.** Blueprint §32's reference tree (`api/`, `policy/`, `grants/`,
+- **No implementation layout.** The v0.1 Blueprint's reference tree (`api/`,
-  `deploy/`, …) described the withdrawn engine and does not apply. If work here starts
+  `policy/`, `grants/`, `deploy/`, …) described the withdrawn engine and does
-  producing services, schemas that resolve, or anything evaluated at request time, stop —
+  not apply. If work here starts producing services, schemas that resolve, or
-  that belongs to an engine.
+  anything evaluated at request time, stop — that belongs to an engine.
 - Assurance tests `T-01`…`T-10` are **specifications** authored here and executed by
   whitehat-security. Writing the specification is Gate House's job; running the attack and
   judging whether the control held is not.

README.md

@@ -172,16 +172,15 @@ gate-house asserts an invariant
 | [`spec/ActiveSecretsManagementCanon_v0.3.md`](spec/ActiveSecretsManagementCanon_v0.3.md) | the working canon — invariants, controls, profiles, assurance tests |
 | [`docs/contracts/authority-context.md`](docs/contracts/authority-context.md) | normative authority-context vocabulary consumed by access-engine |
 | [`docs/adr/`](docs/adr/) | architecture decisions for Gate House doctrine and contracts |
-| [`ArchitectureBlueprint.md`](ArchitectureBlueprint.md) | architecture; **predates the re-cut and is being revised** |
+| [`ArchitectureBlueprint.md`](ArchitectureBlueprint.md) | current doctrine architecture and responsibility contracts |
 | [`decisions/decisions.md`](decisions/decisions.md) | decision records — start with GH-DEC-2026-001 |
 | [`history/`](history/) | reference notes; the 2026-08-28 review is the origin of the current shape |
 | [`workplans/`](workplans/) | work in flight |
 
 **Status.** Specification-only; no code, by design. `INTENT.md`, the decision
-record, and the canon standard reflect the current shape.
+record, the canon standard, and `ArchitectureBlueprint.md` reflect the current
-`ArchitectureBlueprint.md` still describes the withdrawn engine framing in its
+shape. The withdrawn authority-plane design is preserved under `history/` and
-component, evaluation-order, API, and storage sections; its domain model,
+in Git, not in the working architecture.
-operating modes, change dynamics, MCP integration, and test program survive.
 
 ---
 

WORK-RECORDS.md

@@ -13,7 +13,7 @@
 | task | GH-WP-0001-T01 | done | — | workplans/GH-WP-0001-foundation.md |
 | task | GH-WP-0001-T02 | done | — | workplans/GH-WP-0001-foundation.md |
 | task | GH-WP-0001-T03 | done | — | workplans/GH-WP-0001-foundation.md |
-| task | GH-WP-0001-T04 | todo | — | workplans/GH-WP-0001-foundation.md |
+| task | GH-WP-0001-T04 | done | — | workplans/GH-WP-0001-foundation.md |
 | task | GH-WP-0001-T05 | todo | — | workplans/GH-WP-0001-foundation.md |
 | task | GH-WP-0001-T06 | todo | — | workplans/GH-WP-0001-foundation.md |
 | task | GH-WP-0002-T01 | done | — | workplans/GH-WP-0002-approval-evidence-integrity.md |

history/2026-09-01-authority-plane-blueprint-retirement.md

@@ -0,0 +1,76 @@
+# Authority-plane Blueprint retirement
+
+**Repository:** `gate-house`
+**Project family:** NetKingdom
+**Status:** Design history; non-normative
+**Date:** 2026-09-01
+**Decision:** `decisions/decisions.md` GH-DEC-2026-001
+**Workplan:** GH-WP-0001-T05
+
+## Purpose
+
+This note records the retirement of `ArchitectureBlueprint.md` v0.1 and the
+disposition of its sections. It prevents withdrawn engine design from remaining
+in the working architecture while preserving the original argument and text.
+
+The complete pre-revision document is recoverable without copying 2,500 lines
+of obsolete direction into current documentation:
+
+```text
+git show 75ce372:ArchitectureBlueprint.md
+```
+
+Commit `75ce372` is the T04 completion and contains the last complete v0.1
+Blueprint before T05 began.
+
+## Why it was retired
+
+Version 0.1 described Gate House as a deterministic authority plane with an
+`/authorize` API, policy evaluation, grants, revocation, storage, deployment,
+and operational targets. GH-DEC-2026-001 rejected that placement: Gate House is
+non-deterministic Staff, while access-engine is the only policy decision point.
+
+Building the old design in this repository would have violated the doctrine's
+first boundary in its own home: cognition would have acquired a path to
+privilege.
+
+## Section disposition
+
+| v0.1 section | Disposition in v0.2 |
+| --- | --- |
+| §1–4 purpose, goals, non-goals, context | Rewritten around a Staff-layer doctrine artifact and the estate responsibility boundary. |
+| §5 three-plane model | Replaced by the accepted Taxonomy → Tooling → Engines → Staff layer model. Gate House's former Authority Plane placement is withdrawn. |
+| §6 core domain model | Retained and tightened in v0.2 §3. Runtime-owned grant and decision terms are explicitly attributed to access-engine. |
+| §7 canonical authorization request | Replaced by `docs/contracts/authority-context.md`; no Gate House wire format or endpoint. |
+| §8–9 canonical decision and decision types | Decision vocabulary retained; schema and emission belong to access-engine. |
+| §10–13 components, policy architecture, evaluation order | Withdrawn as access-engine implementation design. The monotonic-restriction invariant survives without prescribing an algorithm. |
+| §14–15 Assistant and Autonomous modes | Retained as security regimes in v0.2 §5. Gate House is removed from runtime flows. |
+| §16 King's Guard integration | Retained as the restrictive posture and containment contract in v0.2 §8. |
+| §17 secrets/OpenBao integration | Retained as responsibility and credential-separation doctrine in v0.2 §9. Direct Gate House integration is withdrawn. |
+| §18 execution gateway | Retained as a preference for trusted brokered execution, owned by the execution and credential repositories. |
+| §19 MCP integration | Retained as capability-not-authority doctrine in v0.2 §10. |
+| §20–21 change dynamics and circuit breakers | Retained as the Change Dynamics Envelope and independent stop-path obligations in v0.2 §11. Runtime mechanisms belong to Engines. |
+| §22 multi-tenancy | Retained as explicit-scope doctrine in v0.2 §12. |
+| §23 policy self-modification | Retained as independent-governance doctrine in v0.2 §12. |
+| §24 audit architecture | Retained in v0.2 §13, corrected with the archive-completeness bound and per-source emission ownership. Gate House as audit writer is withdrawn. |
+| §25–26 storage and API | Withdrawn completely as Gate House runtime design. |
+| §27 trust boundaries | Replaced by v0.2 §2. Gate House is outside the runtime trust path. |
+| §28 failure modes | Retained as cross-component doctrine in v0.2 §14, with local-outbox revocation semantics from GH-DEC-2026-002. |
+| §29 caching | Implementation ownership moved to consuming Engines; only the no-expansion-on-staleness rule survives. |
+| §30–32 deployment, technology, repository layout | Withdrawn completely. Gate House is specification-only. |
+| §33 end-to-end scenarios | Reconciled to INTENT's UC-01…UC-05 and referenced by v0.2 §16. |
+| §34 security test program | Reconciled to the Canon's T-01…T-10. Gate House specifies; whitehat-security executes. |
+| §35–38 performance, availability, observability, admin UI | Withdrawn as service requirements. Cross-estate evidence and failure obligations survive without Gate House SLOs or interfaces. |
+| §39 governance integration | Mandate model retained as a logical governance shape in v0.2 §6, not a Gate House database schema. |
+| §40 ADR backlog | Reclassified in v0.2 §17. ADR-003 lapsed; Engine implementation choices moved to their owning repositories. |
+| §41 prototype milestones | M0, M3, and M4 lapsed. Remaining concerns are doctrine, owning-repository work, or assurance targets rather than Gate House implementation milestones. |
+| §42 longer-term evolution | Replaced by INTENT success criteria and the conformance loop. |
+| §43 invariants | Stable A-01…A-15 identifiers retained and corrected for ownership in v0.2 §15. |
+| §44 summary | Replaced: Gate House establishes doctrine and no longer appears in the request path. |
+
+## What retirement means
+
+The v0.1 text remains useful evidence of why the boundary was redrawn. It is
+not an implementation backlog. Citations to it must identify it as historical;
+new architecture and workplans cite v0.2, the authority-context contract, the
+Canon, or the governing decision.

workplans/GH-WP-0001-foundation.md

@@ -87,7 +87,7 @@ boundary and the three-role identity model.
 
 ```task
 id: GH-WP-0001-T05
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "010e3162-cab1-5644-b262-b0d1d7d676f8"
 ```
@@ -98,6 +98,12 @@ doctrine, change dynamics, audit, architectural invariants — into doctrine for
 and retire the withdrawn sections from the working document into design history.
 Currently marked in place with a status banner.
 
+Done — `ArchitectureBlueprint.md` v0.2 is a current doctrine architecture with
+no Gate House runtime role. The complete v0.1 remains recoverable at Git object
+`75ce372:ArchitectureBlueprint.md`; its section-by-section disposition is in
+`history/2026-09-01-authority-plane-blueprint-retirement.md`. Derivative README
+and agent guidance now point to the current document.
+
 ```task
 id: GH-WP-0001-T06
 status: todo