gate-house/workplans/GH-WP-0003-statute-v08-amendment-set.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	state_hub_workstream_id
GH-WP-0003	workplan	Security layer model v0.8 amendment set	infotech	gate-house	finished	codex	infotech	2026-09-05	2026-09-09	a331dc88-c9bc-5d2a-9ff1-2aa7e837c3bb

Security layer model v0.8 amendment set

Goal

Land the queued amendments to security-layer-model as v0.8: the §9.7.3 consume-ordering protocol clarification, the §11 emission-guarantee declaration check, the §13/§13.1 register disposition against maturity-engine, the §9.5 posture/maturity recomputability boundary, and the GH-DEC-2026-005 split-validation doctrine. Each is currently doctrine held in a gate-house contract or decision rather than in the accepted statute.

Normative text for A1–A6 is drafted at docs/amendments/v0.8-amendment-set.md. That file is the reviewable unit: each amendment carries its own wording, defect statement, and authority, so it can be argued before anything touches a cut document. T06 assembles from it.

Why now

security-layer-model_v0.7.md is accepted and must not be patched in place. Since its acceptance, five separate rulings have been made that belong in the statute and are currently held in gate-house contracts, decision records, or a reply in another repository's inbox. Each was correctly kept out of v0.7; together they are now a version.

The risk of leaving them scattered is not that any one is wrong — each was argued where it was made. It is that a reader of the accepted statute gets an answer that the estate no longer holds, and that the register sections (§13, §13.1) are accumulating rows in a document that four repositories have said should be a pointer.

Gate House authors the amendment set. net-kingdom publishes. Nothing here edits v0.7.

id: GH-WP-0003-T01
status: done
priority: high
state_hub_task_id: "330d9739-f172-536d-82f6-74eec03902e0"

§9.7.3 — consume ordering. v0.7 reads as if the protected action must precede the consume call. GH-DEC-2026-003 and docs/contracts/approval-consumption.md establish the opposite: the PEP MUST obtain a successful consume before the side effect, because act-then-consume lets CAS prevent only the second record and not the second side effect. Carry the clarification into §9.7.3 without retracting the forensic claim that consumption MUST NOT be inferred from a decision record.

id: GH-WP-0003-T02
status: done
priority: high
state_hub_task_id: "fe278b70-8c05-539c-9f41-4019c3c35520"

§11 — emission-guarantee declaration check. Add the conformance check drafted as the last section of docs/contracts/approval-emission-detection.md: a load-bearing evidence source declares a local outbox plus heartbeat-or-reconciliation; an attributive non-atomic source declares the trade and does not claim completeness. This exists so the next engine catalogued as an evidence source cannot reintroduce the GH-IN-0001 gap silently.

id: GH-WP-0003-T03
status: done
priority: high
state_hub_task_id: "6d5efa1a-54d9-5995-bfac-d2a9f5291469"

§13 and §13.1 — register disposition. maturity-engine (MAT-WP-0001) holds the §13 gap-register snapshot and the §13.1 stance-map inventory as queryable data, with ASM-0…ASM-6 registered as data owned by gate-house and pep-stance-publication owned by ops-warden. Four repositories have offered §13.1 rows — user-engine/pep-stance.yaml, tenant-engine/pep-stance.yaml, ops-warden published, ops-mason unpublished.

Decide whether §13 becomes a pointer to maturity-engine or stays a table. The argument for the pointer is that a hand-maintained table in a statute is a register that drifts, and that transcribing rows is exactly the manual step the engine exists to remove. The argument against is that a statute must be readable without a live query. Both are real; settle it as a decision record rather than by editing.

Settled as GH-DEC-2026-006: the registers become pointers, and not before maturity-engine publishes a committed, versioned export readable without a live query. Publication is the precondition, not the follow-up. Until it lands the tables stay and rows are transcribed, so the four outstanding stance-map offers are inventoried in v0.8 either way — user-engine, tenant-engine, ops-warden (published) and ops-mason (unpublished).

id: GH-WP-0003-T04
status: done
priority: medium
state_hub_task_id: "89ffd56e-5abf-5003-889e-1d00c3453b23"

§9.5 — the posture/maturity boundary. kings-guard (KG-DEC-2026-002, kings-guard/docs/PostureMaturityBoundary.md) argues that the discriminator is recomputability, not volatility: given the same criteria and the same evidence, if you MUST get the same answer it is maturity and belongs in an engine; if you CANNOT promise the same answer it is posture and belongs in Staff. The argument is that volatility describes the two things without partitioning them, and every case it does not obviously cover becomes an argument at exactly the boundary §6 says must not be open to argument.

Disposed as GH-DEC-2026-007: adopted, with one added clause. Recomputability is assessed over the stated criteria, so a criterion that dereferences a judgment ("level 2 iff the reviewer marked it adequate") is deterministic in form and inferential in substance. A criterion MUST therefore bottom out in evidence about the subject, not in another party's conclusion about it. All three kings-guard consequences are carried, including the constraint they volunteered against themselves — capability readiness MUST NOT be an input to posture — and their honest limit, that "the same evidence" is undefined until §17, is recorded in the statute beside the test rather than left in the commentary.

id: GH-WP-0003-T05
status: done
priority: medium
state_hub_task_id: "087d3f67-66ef-59a3-8d4b-26ebfa5b2d00"

Split validation as statute. GH-DEC-2026-005 states that a PEP validates each artifact against the layer that owns its data and that a PIP MUST NOT republish the PDP's decision. That is a general property of the layer model, not a fact about the approval path, and it currently lives only in a decision record and a contract. Place it in the statute where §8's three-way split is stated.

id: GH-WP-0003-T06
status: done
priority: medium
state_hub_task_id: "ecc01a7b-22df-5a9c-a29b-eb7559713ca7"

Assemble, circulate, publish. Cut security-layer-model_v0.8.md, circulate for assent as v0.6 and v0.7 were, and hand to net-kingdom for publication. Record dispositions of the returned findings. v0.7 stays accepted and unedited until v0.8 is accepted in its place.

id: GH-WP-0003-T07
status: done
priority: low
state_hub_task_id: "d68be07d-2528-52a2-8de5-909890eb7758"

§17 — refresh the ownership paragraph. §17 closes with "Ownership is proposed, not assigned… Neither has assented." GH-DEC-2026-004 assigned the split and both info-tech-canon (ITC-WP-0018, ITC-EMISSION-CADENCE 0.1 in canon 0.7.0) and net-kingdom (NK-WP-0035, emission-cadence-security-profile_v0.1.md) have accepted in their own voice. Replace the paragraph with the settled ownership and cite the decision; keep §17's drafter credit to kings-guard.

Surfaced by docs/conformance/2026-09-06-v06-findings-audit.md, which also confirms that all fifteen v0.6 review findings are dispositioned in v0.7 — this is the one paragraph a later decision made stale, not a missed finding.

id: GH-WP-0003-T08
status: done
priority: medium
state_hub_task_id: "ce6a814f-f854-52af-8e3c-205bf240f487"

Derived summaries must be marked (A7). Four instances in one week, in four repositories, of a repository acting on a derived summary rather than the authoritative body — a stale revisit trigger here, a change log read for section text here, a dual-control rule written against an assumed schema in access-engine, a fixture read for contract prose in secrets-engine. Proposed by approval-engine on the observation that at four instances it is a property of how the estate publishes rather than four separate lapses: authoritative bodies with derived summaries beside them and no staleness marker on the derivatives.

Now six instances in four repositories, and A7 is drafted in two tiers on approval-engine's proposal: a §11 mechanical check (published examples validate against the schema they exemplify, and cover both shapes of an optional load-bearing field) and a §12 convention (derivatives marked with source and derivation version; dated review records marked as status-as-of-date). Four of the six were self-reported and one was committed by the repository arguing for the rule, which is the argument that the publishing shape makes the error the default rather than that four repositories were careless. The limit is stated in the draft: the mechanical half catches example drift, the convention half makes prose staleness visible without detecting it.

id: GH-WP-0003-T09
status: done
priority: high
state_hub_task_id: "e3a7dfb7-f6ea-5dcf-ad02-602aca969449"

unknown and the scoping axis (A8). access-engine exercised the divergence capability it claimed in the v0.6 round, on the first occasion §13.1 held two rows. ops-warden resolves unknown to fail_open and secrets-engine to fail_closed; both maps are conformant, total and test-pinned, and they disagree about the case nobody planned for. The two maps also scope over different axes, so the register cannot answer the question an inventory exists to answer.

Settled as GH-DEC-2026-009 and drafted as A8: unknown is not a zone and fails closed, because the §9.3 trade requires knowing the zone and a permissive unknown makes being unclassifiable a privilege escalation needing no credential; and each map declares its axis and its relation to zone, with the register stating what it cannot answer rather than implying it can. ops-warden acquires one non-conformant cell at v0.8 and it goes to the assent round rather than being imposed.

---

T06 status

Round closed 2026-09-09; publication handed to net-kingdom. security-layer-model_v0.8.md remains status: proposed at net-kingdom@64394e9. The acceptance flip and publication are net-kingdom's and it has confirmed it will run them on round close. security-layer-model_v0.7.md stays accepted and in force until then, unpatched.

Four repositories returned text reviews — access-engine (four findings), approval-engine (one partial plus three), ops-warden (two findings and one agreement), and net-kingdom (§17 confirmed, §11 corrected in place at da7747d). All are dispositioned in docs/conformance/2026-09-06-v08-assent-round.md.

Nine corrections landed in the text during circulation, listed as §15 items 12–20. Two rulings were substantive enough to carry their own records:

• GH-DEC-2026-010 — a PEP must be able to attribute a decision to access-engine, and obligation 2's digest test does not discharge obligation 1. Fail-closed protects against a decision point that is absent, not against one that lies. Carried as a declared §13 gap with access-engine as owner.
• GH-DEC-2026-011 — ops-warden's asked-for transitional unknown: fail_open is declined; §13.1 records a dated classification-coverage figure beside each stance instead. Also settles that a map must enumerate its axis and that an absent scope is distinguishable from an unknown one — closing the §16 question this version opened.

kings-guard and audit-core did not return a review. §14 records that as not claimed. The sections they were asked to attack — §9.5's criteria-grounding clause and §12's step-four paragraph; §11's emission-guarantee wording — carry no assent from the repository best placed to test them. That is a gap in the round, not a defect in the text, and it does not block publication.