Architecture Blueprint and rewritten SCOPE; close T05 and T06

T05 written after the ruling rather than before it, which was the point of
gating it. GH-DEC-2026-012 limit 3 did most of the shaping: the evidence copy
must reach audit-core independently of this component, because here the actor
being audited and the evidence source are the same. Booked as four binding
implementation consequences plus O-02, which must be resolved before T08 ships —
"we will add the independent path later" is how limit 3 becomes
limit-3-in-principle.

Other constraints fixed in the blueprint: presentation/ is the only writer of
view_hash; the approval-engine client exposes no validity cache; a fail-closed
outcome is never recorded as an approver's decline, since the human made none;
the assurance shape is cited from key-cape's contract rather than restated so it
cannot drift; and no polling loop may synthesise the inbox approval-engine
refuses to provide.

T06 closed with the SCOPE.md rewrite the ruling unblocked. It carries a "What
this repository does not claim" section, because a scope file listing only
capabilities overstates them: the decision path is not validated while
GH-DEC-2026-010 is open, the residual is not closed, view_hash is not inside the
approval entry, and nothing is deployed.

Two open items block the remainder. O-01, the human token tenant, blocks T07 and
is not ours alone to decide. O-02, the independent evidence path, blocks T08.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3W1dQG7GFFM9d94jFx7iR

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1565372@bnt-lap001
Assistant-Session: 16bb2f25-b34c-49ef-8e94-5fec3567a568

SCOPE.md

@@ -6,16 +6,15 @@
 
 ## Status — 2026-09-09
 
-**Nothing is implemented.** This repository currently contains founding
-documents, the preserved founding exploration under `history/`, and
-`workplans/INFD-WP-0001`. There is no package, no service, no deployment, and
-no UI.
+**Specification and declaration are complete; no service is deployed.**
 
-This file exists because the Repo Manager requires it and because an honest
-empty boundary is more useful than an imagined one. It is rewritten in
-`INFD-WP-0001-T06`, once the `gate-house` layer ruling (T02) and the
-specifications (T03–T05) have fixed the real boundary. **Do not read the
-sections below as describing working code.**
+What exists and is tested: the layer and stance declarations (`layer.yaml`,
+`pep-stance.yaml`, `informed_decision/stance.py`), the governed canonicalizer
+and schema, and the four specs under `docs/specs/`. 46 tests pass.
+
+What does not exist: any HTTP surface, any storage, any UI, any deployment. The
+walking skeleton is `INFD-WP-0001-T08` and is gated on an external decision
+(§"Open" below).
 
 ## One-liner
 
@@ -24,30 +23,52 @@ renders a Decision Memo to the human who holds the mandate, records what was
 shown, and binds their identity to the act — and owns the browser-facing
 approver UI that `approval-engine` deliberately does not contain.
 
+## Layer
+
+**PEP-shaped**, ruled by `GH-DEC-2026-012`. Not an Engine. Companion §5 owed,
+statute §6.4 in full. Declared in `layer.yaml` in this repository's own voice.
+
+It emits one PIP-like fact — *what was presented* — as a claim, under three
+limits that are the substance of the permission rather than caveats on it:
+
+1. the claim carries presentation and nothing else, and must never carry,
+   restate, summarise or imply a decision or verdict;
+2. the claim must never be an input to the decision it presents for;
+3. the evidence copy reaches `audit-core` **independently** of this repository.
+
+Limit 2 is load-bearing: the argument that a renderer attesting its own
+rendering is not self-dealing was accepted *because* that limit holds.
+
 ## Core Idea
 
 A decision surface is not a workflow engine and not a decision point. This
 repository owns the Decision Memo object, the presentation record, the
-canonicalization that produces `view_hash` / `awareness_hash`, the disposition
+canonicalization producing `view_hash` / `awareness_hash`, the disposition
 vocabulary, and the evidence bundle export. It does not evaluate whether an act
 is permitted, does not hold approval current-state, and does not archive the
 trail.
 
-## In Scope — first cut (Stage 1, not yet built)
+## In Scope — first cut (Stage 1)
 
-- The Decision Memo object and its versions, promoted from
-  `history/20260909-initial-exploration/` into governed `schemas/`.
-- Canonicalization of the binding and awareness documents, with the four
-  isolation vectors under test.
-- The presentation record: what was rendered, to whom, when, in which locale
-  and UI release.
+**Built and tested:**
+
+- Canonicalization of the binding and awareness documents, with the three
+  published vectors reproducing byte for byte and all four isolation properties
+  pinned (`tests/test_canonicalize.py`).
+- The Decision Memo schema and worked examples, governed under `schemas/`.
+- The unreachable-engine stance map, built to v0.8 obligation 3, with
+  published-equals-shipped asserted by test (`tests/test_layer_conformance.py`).
+
+**Specified, not built:**
+
+- The presentation record: what was rendered, to whom, when, in which locale and
+  UI release.
 - Required-highlight acknowledgment as a precondition of binding.
-- The disposition vocabulary — `comment`, `discuss`, `return`, `forward`,
-  `escalate`, `acknowledge`, `accept`, `decline`, `withdraw`, `configure` —
-  and its legality tables.
-- The browser-facing OIDC client for human principals: authorization-code +
-  PKCE against `key-cape`, yielding a token with `aud=approval-engine`,
-  `principal_type: human`, scope `approval:approve`.
+- The disposition vocabulary and its legality tables. Only `accept` reaches
+  `approval-engine`; `return`, `discuss`, `escalate` and the rest are
+  memo-level.
+- The browser-facing OIDC client: authorization-code + S256 PKCE against
+  `key-cape`, scopes `[openid, approval:read, approval:approve]`.
 - An L3 approver surface calling `approval-engine`'s approval-entry mutation.
 - The evidence bundle as an offline-verifiable export.
 
@@ -55,21 +76,40 @@ trail.
 
 - Authorization decisions — `access-engine`, always and only (statute §6).
 - The approval object, its state machine, validity and consumption —
-  `approval-engine`. This surface never caches validity, never infers
-  consumption, never requests `approval:consume`.
-- Approval doctrine: which acts require approval, how many approvers, which
-  separations of duty — `gate-house`.
-- Identity and authentication — `key-cape`. Identity is imported, never
-  invented here.
-- The evidence archive — `audit-core`. This repository emits and exports.
+  `approval-engine`. Never cached, never inferred, never `approval:consume`.
+- Approval doctrine — `gate-house`.
+- Identity and authentication — `key-cape`. Imported, never invented. The
+  `assurance` shape is `key-cape`'s and is cited, not restated.
+- The evidence archive — `audit-core`.
 - Credentials materialized after a decision — `secrets-engine`.
-- Notification transport, ticketing, and general workflow.
-- L4/L5, QES, QTSP integration, qualified archival retention.
-- The mandate graph. Stage 1 routes to a named approver and does not maintain a
-  map of who may bind what — a known, accepted limitation recorded in `GOAL.md`.
+- Notification transport, ticketing, general workflow.
+- **An approvals inbox.** Foreclosed upstream as well as here:
+  `approval-engine` exposes get-by-id only and will not add a list.
+- L4/L5, QES, QTSP, qualified archival retention.
+- The mandate graph — so a Stage 1 `escalate` is an assertion, not a verified
+  claim.
 
-## Layer placement
+## What this repository does not claim
 
-**Provisional and unratified.** The working position is PEP-shaped under
-statute §6.4 and companion §5. `layer.yaml` does not exist yet and is written
-from the `gate-house` ruling in `INFD-WP-0001-T02`, not from this file.
+Stated here because a scope file that only lists capabilities overstates them.
+
+- **The decision path is not validated.** `GH-DEC-2026-010` requires a decision
+  be attributable to `access-engine`; no consumer can satisfy that today because
+  the envelope is unsigned (`FLEX-WP-0024`). This surface records
+  `decision_attributable: false` and must not describe validation as complete.
+- **The residual is open.** A compromised surface can present X and attest Y.
+  `GH-DEC-2026-012` states it is not closed and does not credit this repository
+  with closing it.
+- **`view_hash` is not inside the approval entry.** `POST /entries` discards its
+  body by design. Correlation is `(approval_id, subject, approved_at)`, so an
+  auditor holding only the approval object cannot reach the presentation.
+- **Nothing is deployed**, so nothing is observed in production and nothing is
+  contained automatically.
+
+## Open
+
+- **Human token tenant** — blocks `T07`. A human access token cannot carry
+  `tenant:platform` today. Registration-bound versus directory-sourced; not this
+  repository's to decide alone.
+- **The independent evidence path** — mechanism unchosen; required by limit 3
+  before `T08` ships.