State two properties once, and repair SCOPE.md's withdrawn framing

Two things this week's rulings left owed, both the failure mode those
rulings were about.

A-16 and A-17, and Core Rules 16 and 17. Two general properties had
been stated three times each, always against the instance that produced
them and nowhere in general — which is how a property gets found by
accident or not at all. That is the defect gate-house corrected in
three other repositories this month while carrying it here.

A-16, distinguishable routes: where one observable state is reachable
by two routes differing in security meaning, the record must say which.
Four instances, and they only look like one rule once they are next to
each other — an envelope identical whether access-engine issued it or a
responder forged it (GH-DEC-2026-010), unknown versus absent in a
stance map (-011), a tenant claim directory-asserted versus
registration-supplied (-013), erased versus never held on an evidence
path (-014). The rule is not that the routes must diverge; usually they
must behave identically and safely. It is that a later reader can tell
them apart, or a sound check gets read as carrying a property it does
not have.

A-17, fail-closed transitions: a transitional deviation is admissible
only where it fails closed on the case distinguishing it from the
conformant state. Written because two requests for transitional relief
arrived in one week and were answered oppositely, and the answers would
otherwise read as arbitrary rather than as one rule.

Both are marked repository-level and explicitly not estate doctrine.
Graduation waits on a repository that bears a cost under them having
argued them, which is the bar security-layer-model met and these have
not.

SCOPE.md was still the withdrawn authority-plane framing. It opened by
saying gate-house "decides whether a requested action is authorized"
and listed deterministic authorization decisions as in scope — the
design retired by GH-DEC-2026-001, surviving in a derived document a
reader would take as current, with a dead pointer to Blueprint section
3 non-goals that the re-cut removed. Rewritten from current INTENT,
including what is not owned here and what would put the repository out
of scope.

The irony is noted rather than hidden: a derived artifact contradicting
its source, in the repository that generalised that failure into
statute section 12 after finding six instances in one week elsewhere.

rmgr conform clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012viPor8WJNCbV64ipwewrm

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1754332@bnt-lap001
Assistant-Session: 9c8ac536-ff5e-46a3-8ab1-a548bde25fc0

ArchitectureBlueprint.md

@@ -4,8 +4,8 @@
 **Project family:** NetKingdom
 **Artifact:** `ArchitectureBlueprint.md`
 **Status:** Current — doctrine architecture; no runtime role
-**Version:** 0.2
-**Date:** 2026-09-01
+**Version:** 0.3
+**Date:** 2026-09-10
 **Decision:** `decisions/decisions.md` GH-DEC-2026-001
 
 ---
@@ -545,6 +545,49 @@ Assistant sessions do not silently become Autonomous sessions.
 
 Deterministic boundaries continue to hold when every agent behaves incorrectly.
 
+### A-16 — Distinguishable routes
+
+Where one observable state is reachable by two routes that differ in security
+meaning, the record distinguishes which route produced it.
+
+The two routes usually behave identically, and must — `unknown` and `absent` both
+fail closed, and should. A-16 is not a requirement that they diverge; it is a
+requirement that a later reader can tell them apart. Where they cannot, a sound
+check gets read as establishing a property it does not carry, and the safer
+reading of the appearance becomes unavailable to everyone.
+
+Instances: `GH-DEC-2026-010` (a decision envelope reads identically whether
+`access-engine` issued it or a responder forged it), `GH-DEC-2026-011` (`unknown`
+versus `absent` in a stance map), `GH-DEC-2026-013` (a `tenant` claim
+directory-asserted about the principal versus registration-supplied about the
+client), `GH-DEC-2026-014` (*erased* versus *never held* on an evidence path).
+
+### A-17 — Fail-closed transitions
+
+A transitional deviation from an invariant is admissible only where it fails
+closed on the case that distinguishes it from the conformant state.
+
+This governs what may enter the declared-gap register rather than what a system
+does at runtime. The admitting question is not the quality of the design or the
+length of the transition, but the direction of failure at the distinguishing
+case. A promise that fails open is a permission; a promise that fails closed is a
+gap.
+
+Instances: `GH-DEC-2026-011` (a dated transitional `unknown: fail_open` declined
+— its distinguishing case is exactly where it fails open, so the transition
+licenses the forbidden thing and dates it), `GH-DEC-2026-013` (a
+registration-bound tenant granted — registration and directory disagreeing
+refuses issuance rather than picking a winner), `GH-DEC-2026-014` (commitment-only
+evidence granted — a reviewer who cannot obtain the content gets no
+reconstruction rather than a wrong one).
+
+**A-16 and A-17 are newer than A-01…A-15 and are not yet estate doctrine.** They
+are stated here because a property recorded only against the instance that
+produced it is found by accident or not at all. Graduation to
+`net-kingdom/canon/standards/` waits on a repository bearing a cost under them
+having argued them, which is the bar `security-layer-model` met and these have
+not.
+
 ## 16. Conformance architecture
 
 Gate House doctrine is real only when the loop turns:

INTENT.md

@@ -4,8 +4,8 @@
 **Project family:** NetKingdom
 **Layer:** Staff
 **Status:** Re-cut as the security and defence doctrine council
-**Version:** 0.2
-**Date:** 2026-08-28
+**Version:** 0.3
+**Date:** 2026-09-10
 **Supersedes:** v0.1 (2026-08-24), which framed Gate House as a deterministic authority plane. See `history/2026-08-28-security-layer-model-and-gate-house-recut.md` for why that framing was withdrawn.
 
 ## The Mission
@@ -284,7 +284,7 @@ credential never enters model context.
 
 ## Core Rules
 
-The doctrine, in fifteen lines. Gate House authors and maintains these; the
+The doctrine, in seventeen lines. Gate House authors and maintains these; the
 engines and Staff repositories implement them.
 
 1. **No privilege from cognition.**
@@ -302,6 +302,42 @@ engines and Staff repositories implement them.
 13. **Audit evidence is protected from the actor being audited.**
 14. **Failure of critical policy or authorization dependencies fails closed.**
 15. **Production guarantees must survive incorrect agent behavior.**
+16. **Where one appearance is reachable by two routes, the record says which route.**
+17. **A transitional deviation is admissible only where it fails closed on the case that distinguishes it from the conformant state.**
+
+**On rules 16 and 17, which are newer than the rest.** Both were derived in
+September 2026 from rulings that kept arriving at the same shape, and they are
+stated here because a property recorded only against the instance that produced it
+is found by accident or not at all — the failure this repository has now corrected
+in other repositories three times.
+
+**Rule 16** is the more load-bearing. Its instances so far: a stance map where
+`unknown` and `absent` fail closed identically but mean different things
+(`GH-DEC-2026-011`); a `tenant` claim that reads the same whether the directory
+asserted it about the person or a client registration supplied it
+(`GH-DEC-2026-013`); an evidence path where *erased* and *never held* both present
+as a blank (`GH-DEC-2026-014`); and a decision envelope that looks identical
+whether `access-engine` issued it or a responder forged it (`GH-DEC-2026-010`).
+In each, a sound check is read as establishing a property it does not carry,
+because the appearance the check produces is reachable two ways. The rule is not
+that the two routes must behave differently — usually they must behave identically,
+and safely. It is that the **record** must distinguish them, or the safer reading of
+the appearance becomes unavailable to every later reader.
+
+**Rule 17** governs what may enter a declared-gap register. It exists because two
+requests for transitional relief arrived in one week and had to be answered
+oppositely without the answers looking arbitrary: `ops-warden`'s dated transitional
+`unknown: fail_open` was declined (`GH-DEC-2026-011`) and `key-cape`'s
+registration-bound tenant was granted (`GH-DEC-2026-013`). The distinguishing
+question is not how careful the design is or how long the transition lasts, but
+which way it fails on the case that separates it from the conformant state. A
+promise that fails open is a permission; a promise that fails closed is a gap; only
+the second is a thing a register can hold.
+
+Neither rule has graduated to `net-kingdom/canon/standards/`. They are Gate House
+doctrine at repository level until they have been argued by a repository that bears
+a cost under them — which is how `security-layer-model` earned its acceptance and is
+the bar these have not yet met.
 
 **A bound on rule 13, and on every claim that rests on audit.** An append-only
 archive with a verified hash chain proves records were not *altered or truncated

README.md

@@ -116,7 +116,7 @@ may.
 
 ---
 
-## The doctrine in fifteen lines
+## The doctrine in seventeen lines
 
 1. No privilege from cognition.
 2. Every privileged action crosses a deterministic authority boundary.
@@ -133,6 +133,14 @@ may.
 13. Audit evidence is protected from the actor being audited.
 14. Failure of critical policy or authorization dependencies fails closed.
 15. Production guarantees must survive incorrect agent behavior.
+16. Where one appearance is reachable by two routes, the record says which route.
+17. A transitional deviation is admissible only where it fails closed on the case that distinguishes it from the conformant state.
+
+The last two are September 2026 and are repository-level, not estate doctrine. 16
+is why an `unknown` and an `absent` stance cell must be told apart in the record
+even though both fail closed, and why a decision envelope that looks authentic is
+not therefore attributable. 17 is why one request for transitional relief was
+granted and another declined in the same week. See `INTENT.md` § Core Rules.
 
 ## Agentic operating modes
 

SCOPE.md

@@ -1,38 +1,84 @@
 # Scope
 
-Derived from `INTENT.md`. Gate House is deliberately narrow: it decides whether
-a requested action is authorized, and represents that decision as bounded,
-time-limited authority that downstream systems enforce.
+Derived from `INTENT.md`. Gate House is the council where NetKingdom's security
+and defence doctrine is established, documented, taught, and supervised. It is a
+**Staff**-layer repository: it holds no runtime position and renders no
+authorization decision.
+
+> **The mandate and the operating mode are Gate House's. The decision is
+> access-engine's. The credential is secrets-engine's. The perimeter is
+> ops-mason's and ops-warden's.**
 
 ## In scope
 
-- deterministic authorization decisions (`GRANT` / `DENY` / `REQUIRE_APPROVAL` / `DEFER`)
-- principal / actor / runtime-identity separation
-- mandates, delegation, and attenuation
-- authority ceilings
-- tenant-, environment-, resource-, task-, and time-scoped grants
-- approval binding and step-up requirements
-- posture intake from King's Guard, restricting only
-- change-dynamics limits: quotas, budgets, concurrency, circuit breakers
-- credential-binding contract to Secrets Engine / OpenBao
-- emergency revocation independent of the actor
-- decision evidence, explainability, and protected audit
-- policy and decision versioning; fail-closed semantics
+- **doctrine** — the Active Secrets Management Canon, its invariants, and the
+  argument behind them; doctrine graduates into `net-kingdom/canon/standards/`
+  as it stabilizes
+- the **authority context schema** — what must be *sayable* about an agentic
+  authority request (principal, actor, runtime identity, tenant, environment,
+  mandate, task, operating mode), consumed by access-engine as input claims
+- **principal / actor / runtime-identity separation** as a model
+- **mandates, delegation, attenuation, and authority ceilings** as a model and a
+  governance obligation
+- the **agentic operating modes** — Assistant and Autonomous as distinct security
+  regimes, and the requirements attaching to each
+- the **Change Dynamics Envelope** — how much change the organization tolerates,
+  expressed so engines and Staff can bound it
+- the **posture contract** with King's Guard, including the asymmetry: posture may
+  only restrict
+- the **MCP and tooling doctrine** — tool availability is not permission
+- the **credential-binding contract** stating that credentials are implementation
+  artifacts of a grant, materialized by Secrets Engine after authority exists
+- **fail-closed semantics** and the restrictive-failure rule, as properties the
+  estate must hold
+- **conformance review** — whether an actor's authority in practice matches its
+  declared mandate and ceiling
+- the **assurance specifications** `T-01`…`T-10`, authored here and executed by
+  whitehat-security
+- the **security curriculum** — what operators, assistants, and autonomous agents
+  must understand before they are trusted with authority
+
+Decision types `GRANT` / `DENY` / `REQUIRE_APPROVAL` / `DEFER` are **named** here
+and **rendered** by access-engine.
 
 ## Out of scope
 
-Owned elsewhere in NetKingdom — see the responsibility table in `INTENT.md`:
+Gate House holds no runtime position. Not owned here:
 
-- human identity lifecycle and memberships — User Engine
-- tenant and organizational boundaries — Tenant Engine
-- authentication and federation — Key Cape
-- credential abstraction and lifecycle orchestration — Secrets Engine
-- secret storage, PKI, leases, dynamic secret engines — OpenBao
-- operational execution — Ops Warden
-- construction, reconciliation, recovery — Ops Mason
-- anomaly detection, behavioral risk inference, security memory — King's Guard
-- adversarial testing and attack simulation — Whitehat Security
+- the authorization decision, policy evaluation, or any `/authorize` surface —
+  **access-engine** is NetKingdom's only policy decision point
+- policy engine selection, policy packages, or policy rollout
+- grant storage, credential issuance, leases, or revocation
+- human identity lifecycle and memberships — **User Engine**
+- tenant and organizational boundaries — **Tenant Engine**
+- authentication and federation — **Key Cape**
+- credential abstraction and lifecycle orchestration — **Secrets Engine**
+- secret storage, PKI, leases, dynamic secret engines — **OpenBao**
+- approval storage and lifecycle — **Approval Engine**
+- audit custody and evidence retention — **Audit Core**
+- operational execution, access lanes, SSH certificates, tunnels, host hardening
+  — **Ops Warden**
+- construction, reconciliation, recovery — **Ops Mason**
+- anomaly detection, behavioral risk inference, security memory — **King's Guard**
+- adversarial testing and attack simulation — **Whitehat Security**
+- **the workplans of other repositories**
 
-Also out of scope: inventing a new policy language, becoming an IAM suite,
-secret scanning, SIEM, autonomous remediation, and supporting every agent
-protocol. See "Non-Goals for the First Prototype" in `ArchitectureBlueprint.md` §3.
+That last one is load-bearing. Work structure belongs to the repository doing the
+work. Gate House sets doctrine and reviews conformance; an HQ that starts managing
+the estate's chores has become a second decision point wearing management clothes.
+
+Also out of scope: inventing a new policy language, becoming an IAM suite, secret
+scanning, SIEM, autonomous remediation, and supporting every agent protocol.
+
+## What would put this repository out of scope
+
+If work here starts producing services, schemas that resolve, or anything
+evaluated at request time, it belongs to an engine. A decision point inside Gate
+House would put the deterministic authority boundary inside the non-deterministic
+management layer, violating `INV-02` — the first invariant this repository
+defends. See `decisions/decisions.md` `GH-DEC-2026-001` and
+`history/2026-08-28-security-layer-model-and-gate-house-recut.md`.
+
+The `v0.1` milestones `M0`–`M8` and the reference implementation tree
+(`api/`, `policy/`, `grants/`, `deploy/`) described the withdrawn authority-plane
+design and must not be revived.