tegwick
8698f50706
ADR-015 and the doctrine blueprint now point at the assembled section 3.3 text. Accepted v0.8 still governs. Assistant: grok Assistant-Session: 01a1609f-72b8-7222-9dff-fae300115e42
45 lines
2.1 KiB
Markdown
45 lines
2.1 KiB
Markdown
# Security layer model — ADR-015 engine-section amendment
|
|
|
|
**Repository:** gate-house (author)
|
|
**Publisher:** net-kingdom
|
|
**Status:** assembled into the proposed successor. Not operative.
|
|
**Date:** 2026-10-22
|
|
**Authority:** `gate-house/docs/adr/ADR-015-engine-is-a-processor.md` (accepted 2026-10-22)
|
|
**Base:** `net-kingdom/canon/standards/security-layer-model_v0.8.md` §3.3 (accepted)
|
|
**Cut:** `net-kingdom/canon/standards/security-layer-model_v0.9.md` §3.3
|
|
|
|
## What this document is
|
|
|
|
The reviewable wording for the engine-section graduation of ADR-015.
|
|
|
|
Accepted v0.8 is not patched. The accepted companion stays derived from v0.8.
|
|
The wording is assembled into the proposed v0.9 successor, beside the separate
|
|
GH-DEC-2026-025 staff-evidence candidate. v0.9 remains proposed. v0.8 governs
|
|
until that successor is adopted. This file does not decide ADR-015 again.
|
|
|
|
## What changes
|
|
|
|
§3.3 only, plus the successor's adoption note and change log.
|
|
|
|
- An engine is a tool of automation for one capability. The same inputs yield
|
|
the same result. That is the reliability and efficiency claim.
|
|
- Tooling holds the records. Several engines may use one store.
|
|
- An engine enables. It is not an access-control mechanism by being an engine.
|
|
Restricting who may act stays with `access-engine`.
|
|
- Library, CLI, and service are three manifestations. The credential injected
|
|
at start enables one scoped environment and is not returned to the caller.
|
|
- Operator use is an access rule. Delegation assigns work and transfers
|
|
neither privilege.
|
|
- The Lifecycle role is a capability over a Tooling store. The store may serve
|
|
other engines. The wording "Tooling it owns" is removed.
|
|
- The sentence that every enforcement boundary must sit in an engine is
|
|
removed from §3.3.
|
|
|
|
Unchanged: the four roles, the rule that a new engine is a PIP and cannot be
|
|
a second PDP, the Evidence outage trade, the §4 catalog, and §6.
|
|
|
|
## Normative text
|
|
|
|
The assembled text is §3.3 of
|
|
`net-kingdom/canon/standards/security-layer-model_v0.9.md` as of this date.
|
|
That section is the wording under review. This file does not keep a second copy.
|