Declare concepts and review boundaries for the silent artifacts (T02)

Twelve of the thirteen artifacts that declared nothing now declare what they
define, together with the map-assigned concepts the Organization Model was
missing and the Landscape seed concepts the extractor cannot see because they
are listed rather than defined in prose. The ownership index grows from 164
entries to 750, undeclared prose definitions fall from 637 to 57, and there are
no ownership conflicts. The 57 that remain are overlaps this round assigned to
another owner: imports, each recorded in a boundary review.

The kernel map declares nothing, deliberately, because it assigns concepts to
owners rather than defining them. It is now the only silent artifact and the
suite asserts that, so an artifact added without declarations fails.

itc-org:Authority is declared, with Actor, Ownership, Membership, Role,
Responsibility and Accountability, which SecurityCanon and the identity model
already treat as organization-owned. The regression test that previously
asserted the blind spot now asserts that the kernel map's assignment and the
declaration agree.

Profile is deliberately left undeclared. The kernel map assigns it to Core, the
identity model owns it under accepted CUST-ADR-006, and Observability defines a
runtime performance profile. Three senses need a decision, not a declaration, so
it is recorded as open rather than forced.

Eleven boundary reviews are added beside the artifacts they describe, in the
shape the identity model has used since INFO-WP-0021. The largest finding is
that Core and the Information Space model restate eight provenance concepts in
nearly identical words; Core owns them and Information Space imports. Label,
Drift, Summary and Attribute are resolved by disambiguation rather than
transfer.

make check passes with 50 tests, clean validation, no stale generated assets.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3588@bnt-lap001
Assistant-Session: 24b80f66-e5a7-4e61-99fe-2d422e6d17da

workplans/INFO-WP-0027-concept-declaration-coverage.md

@@ -106,7 +106,7 @@ regression test. `make check` passes with 49 tests.
 
 ```task
 id: INFO-WP-0027-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "b086abf1-3b36-5b05-a8a8-c8b12c9ab280"
 ```
@@ -127,6 +127,64 @@ Expect this task to surface genuine conflicts once the index grows. A conflict
 found here is the workplan working, not a regression; resolve each by naming one
 owner, as ADHOC-2026-09-20-T01 did for `Scope`.
 
+### Result — 2026-09-20 (T02)
+
+Declarations written for twelve of the thirteen silent artifacts, plus the
+map-assigned concepts the Organization Model was missing and the Landscape seed
+concepts the extractor could not see. The ownership index goes from **164 entries
+to 750**, and undeclared prose definitions fall from **637 to 57**, with
+**zero ownership conflicts**. The 57 that remain are the overlaps this round
+assigned to another owner: they are imports, and each is recorded in a boundary
+review.
+
+`kernel/itc-kernel-map` declares nothing, deliberately. It assigns concepts to
+owners rather than defining them, and it is now the only silent artifact — which
+the test suite asserts, so a future artifact that declares nothing fails.
+
+The kernel map's concept-owner table was used as the arbiter wherever it assigns
+an owner, which resolved most overlaps without new judgment. Fifteen concepts it
+does not assign were decided in this round and recorded with rationale.
+
+`itc-org:Authority` — the concept whose absence produced finding F-1 — is now
+declared, along with `Actor`, `Ownership`, `Membership`, `Role`, `Responsibility`
+and `Accountability`, which SecurityCanon and the identity model already treat as
+organization-owned. The regression test asserts the kernel map's assignment and
+the declaration agree.
+
+One concept is deliberately left undeclared. The kernel map assigns `Profile` to
+Core, but the identity model owns `Profile` under accepted CUST-ADR-006, and
+Observability defines a runtime performance profile that the identity boundary
+review already disambiguates. Declaring Core's sense would have created the
+first real conflict; resolving three senses needs a decision, not a declaration.
+It is recorded as open in the kernel boundary review.
+
+### Boundary reviews
+
+```task
+id: INFO-WP-0027-T06
+status: done
+priority: medium
+```
+
+Every artifact that gained a declaration and has an overlap now carries a
+`boundary-review.md` beside it, in the shape the identity model has used since
+INFO-WP-0021: one row per overlapping concept, naming the owner, the resolution
+and whether the kernel map or this review decided it. Eleven were written —
+kernel, access-control, data, devsecops, governance, information-space, network,
+observability, security, task and tagging. Landscape gained declarations without
+overlaps and needs none.
+
+The largest finding is in the kernel review. Core and the Information Space model
+restate eight provenance concepts — `Activity`, `AgentReference`, `Alias`,
+`DecisionRecord`, `ExternalReference`, `Influence`, `Namespace` and `Source` — in
+nearly identical words. Core owns them with the provenance family; Information
+Space imports. Four more were decided by disambiguation rather than transfer:
+`Label` (Core, with Tagging's display sense kept), `Drift` (Core, with Network's
+configuration drift kept), `Summary` (Information Space, with Observability's
+metric aggregation kept) and `Attribute` (Data, with Access Control importing for
+attribute-based decisions). `Exposure` and `Investigation` go to Security;
+`Subject` stays with ITC-ACCESS as SECURITY-DEC-2026-003 records.
+
 ## Report coverage instead of asserting completeness
 
 ```task