coulomb/informed-decision
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Apply GH-DEC-2026-017: declare layer Staff, make layer.yaml derived, answer the section 4 question.

Browse source 
gate-house ruled the section 3 vocabulary closed at four case-insensitive
tokens and named Staff (role pep-shaped unchanged). Both files were changed
the same day, as this repository had committed to. INTENT.md now governs.
layer.yaml is marked derived from INTENT.md and carries no standard or
companion version. The reasoning behind `surface` stays in layer.yaml as
history.

INFD-IN-0006 is closed. INFD-IN-0007 asks once more how section 3.4's Staff
definition fits a deterministic, non-agentic, evidence-holding repository.
It is a question only: nothing waits on it.

Section 4 answer: yes, as a Staff / pep-shaped / evidence-source row. The
emission guarantee is owed per event class: presentation (volume),
disposition (rare), stance-application (rare). See
docs/section-4-catalog-row.md.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
This commit is contained in:
tegwick 2026-09-21 06:33:31 +02:00
parent d0d0bad66d
commit f5cd5d9376
6 changed files with 546 additions and 53 deletions
Download patch file Download diff file Expand all files Collapse all files

213
layer.yaml
View file

@ -1,50 +1,160 @@
# informed-decision — NetKingdom security layer declaration
# informed-decision — NetKingdom security layer declaration (DERIVED)
#
# Framework: net-kingdom/canon/standards/security-layer-model_v0.7.md
# Companion: net-kingdom/SECURITY-COMPANION.md v0.2
# THIS FILE DOES NOT GOVERN. GH-DEC-2026-017 §1 (A11) rules that the `layer:`
# key in INTENT.md frontmatter IS the declaration, and that an equivalent
# declaration file is a DERIVED ARTIFACT which must be marked as derived, must
# name INTENT.md as what it derives from, and must agree with it. §11 already
# said a repository declares its layer in its own INTENT.md; the file form was
# added to give the declaration a machine-readable shape, not a second
# authority.
#
# A disagreement between the two forms is a finding in its own right and must be
# reported rather than resolved away by precedence. There is none here: both
# files carried `surface` in the same casing before the ruling and both carry
# `Staff` after it, changed in one commit.
#
# Framework: net-kingdom/canon/standards/ — the body, UNVERSIONED on purpose.
# Companion: net-kingdom/SECURITY-COMPANION.md
# Voice: INTENT.md (this repository's own, per §11 "who must declare")
# Ruling: GH-DEC-2026-012 (gate-house@0a1d1d9) answered INFD-IN-0001
# Rulings: GH-DEC-2026-012 (INFD-IN-0001) — the shape
# GH-DEC-2026-017 (INFD-IN-0006) — the layer value, the form, the version
#
# Reference form: ops-warden's, adopted by audit-core and kings-guard, with
# kings-guard's adaptation for a repository with no Tooling contacts.
#
# GH-DEC-2026-012 R1 confirmed the SHAPE. The layer is declared here, in this
# repository's own voice, because a layer someone else states about you is not
# a declaration.
# kings-guard's adaptation for a repository with no Tooling contacts. ops-warden
# owns that form and is updating it for GH-DEC-2026-017 §1 and §5 in a parallel
# session; this file applies the two RULED properties (derived marking, absence
# of a standard version) and follows ops-warden's shape for everything else
# rather than inventing one.
schema_version: "0.1"
framework: netkingdom-security-layer-model
standard_version: "0.7"
companion_version: "0.2"
repository: informed-decision
# §3 vocabulary — UNDER RULING, value deliberately unchanged (INFD-IN-0006).
# §11 derived-artifact rule + GH-DEC-2026-017 §1.
derived: true
derives_from: INTENT.md
derives_from_note: >-
INTENT.md frontmatter governs. This file is regenerated from it by hand and
changes in the same commit, so it is derived at the same commit by
construction; if the two ever disagree, INTENT.md is this repository's answer
and the disagreement is itself a finding.
# NO standard_version, and no companion_version — GH-DEC-2026-017 §5 (A12).
# A layer declaration asserts a STANDING property: which layer this repository
# is. That does not change when the standard is revised, and a version here
# makes every revision read as though it invalidated the declaration. The field
# was flagged by this repository on 2026-09-21 and by access-engine in its own
# file; the ruling removes it estate-wide from ops-warden's reference form.
# Version-scoped state belongs in the derived conformance record, which must
# carry the version it was derived at. `companion_version` is removed on the
# same reasoning; it is a version pin in a declaration and nothing in the
# ruling's argument distinguishes it. Raised with ops-warden as part of the
# reference-form update rather than decided here for the estate.
# §3 vocabulary — RULED CLOSED, value corrected 2026-09-21 (INFD-IN-0006).
#
# `surface` denotes the presentation-and-binding tier: the runtime a human
# touches, where a decision rendered elsewhere is shown to a named person, that
# person binds their identity to the act, and the evidence that the presentation
# happened is produced. It was chosen by elimination: GH-DEC-2026-012 R1 ruled
# this repository out of Engine and left the layer to it to declare, and each
# remaining §3 value is false of it — not Staff (deterministic by construction,
# and holding state audit-core depends on at runtime, which §3.4 forbids Staff),
# not Tooling (persists nothing another layer reads), not Taxonomy (nothing but
# a runtime position).
# GH-DEC-2026-017 §3: the §3 vocabulary is CLOSED and has four tokens —
# Taxonomy, Tooling, Engine, Staff. Comparison is ASCII case-insensitive (§2 /
# A9), so no repository is asked to re-spell anything. `surface` is not among
# them: "surface is not a layer... Its correct declaration is layer: Staff, role:
# pep-shaped, which its own file already reasons from two ways." ops-mason and
# ops-warden are the precedent: Staff in the layer column, PEP-shaped in the
# role column.
#
# §3 of security-layer-model_v0.8.md does not enumerate `surface`, and
# flex-auth's validator reads the vocabulary as closed. Surfaced 2026-09-21 by
# the custodian's estate-wide sweep extending FLEX-WP-0030; never raised against
# this repository before. This repository holds that `surface` names a real tier
# §3 does not enumerate, and will change both files the same day without
# argument if gate-house rules the vocabulary closed and names the value.
# Changing it ahead of the ruling would pre-empt gate-house and destroy the
# evidence of what this repository actually concluded.
#
# Request: docs/gate-house-decision-request-layer-vocabulary.md
layer: surface
# Changed the same day the ruling was received, in one commit, with no argument
# — exactly as this repository pre-committed in
# docs/gate-house-decision-request-layer-vocabulary.md §3. `role: pep-shaped` is
# untouched and was already right; a role is not a layer (GH-DEC-2026-012 R2,
# restated by GH-DEC-2026-017 §3 for the declaration field).
layer: Staff
role: pep-shaped
declared_by: INTENT.md
declared_at: "2026-09-09"
ruling: GH-DEC-2026-012
declared_at: "2026-09-09" # the declaration; the VALUE was corrected 2026-09-21
value_corrected_at: "2026-09-21"
ruling: GH-DEC-2026-017
shape_ruling: GH-DEC-2026-012
# ---------------------------------------------------------------------------
# HISTORY — why `surface` was written. KEPT ON PURPOSE, not erased.
#
# GH-DEC-2026-017 §3's reversal condition names this reasoning directly, so it
# has to remain readable: "§3's closure reverses on an argued amendment to §3,
# from a repository that bears a cost under the four-layer cut."
#
# From 2026-09-09 (commit f6376dd) to 2026-09-21 this file and INTENT.md both
# declared `layer: surface`, in the same casing, meaning the
# presentation-and-binding tier: the runtime a human touches, where a decision
# rendered elsewhere is shown to a named person, that person binds their
# identity to the act, and the evidence that the presentation happened is
# produced.
#
# It was chosen by ELIMINATION, not casually. GH-DEC-2026-012 R1 ruled this
# repository out of Engine and left the layer to it to declare, and each
# remaining §3 value was read as false of it:
# - not Staff — deterministic by construction (the same approval rendered to
# the same principal in the same role yields the same
# view_hash, asserted by test), and holding state audit-core
# depends on at runtime, which §3.4 forbids Staff;
# - not Tooling — persists nothing another layer reads;
# - not Taxonomy— nothing but a runtime position.
# Faced with picking a value it believed false or writing the true word and
# carrying the finding, this repository wrote the word and asked for a ruling.
# It did not ask for §3 to be amended in its favour, and it does not now.
#
# The ruling reaches Staff by the same elimination from the other end — not an
# Engine, and nothing else in the four is true, so Staff — and gives the value,
# which is what was asked for and what binds. The part of the elimination above
# that the ruling does not address is recorded as INFD-IN-0007 below. It is a
# question, not a reservation: the value is applied unconditionally.
#
# Request: docs/gate-house-decision-request-layer-vocabulary.md
# ---------------------------------------------------------------------------
# OPEN, non-blocking — INFD-IN-0007.
#
# §3.4 defines Staff as interactive and non-deterministic, working through
# agentic capability, and says Staff repositories MUST NOT hold state that
# another layer depends on at runtime. This repository is deterministic by test,
# forbids an agent from completing its protected act at all, and holds
# presentation evidence audit-core depends on. It is Staff by ruling and the
# declaration above says so. What is not yet written down is how §3's
# determinism cut reaches a deterministic, non-agentic, evidence-holding
# repository — the derivation this repository asked for as a non-condition, and
# which the ruling answers as far as the VALUE and not as far as the FIT.
# Asked once more of gate-house; no deadline, no dependency, nothing waits on it.
section_3_4_fit:
status: open
intake: INFD-IN-0007
blocks_nothing: true
# §4 catalog membership — ASKED by GH-DEC-2026-017 §4, ANSWERED here.
#
# gate-house deliberately did not enrol this repository: adding a row is a canon
# change, and §11's own rule — a layer stated ABOUT a repository BY another is
# not a declaration — applies to catalogue membership at least as strongly. The
# question was put, not decided. This repository's answer is YES, with the
# obligation that comes with it accepted rather than negotiated.
#
# Full argument: docs/section-4-catalog-row.md. Carried by gate-house as
# GH-WP-0004-T06.
catalog:
section_4_row_today: false
declared_voluntarily: true
scope_report: declared-voluntarily-outside-catalog-scope
requested: true
requested_at: "2026-09-21"
requested_row:
repository: informed-decision
layer: Staff
role: pep-shaped
evidence_source: "yes"
accepts_emission_guarantee: true
note: >-
Until the row exists, §11 does not bind this repository and a run that
grades it is over-scoped (GH-DEC-2026-017 §4). That is the reason to ask for
the row, not a reason to avoid it: this repository's presentation evidence
is the only record of what a human was shown before binding, and an evidence
obligation nobody is allowed to check is the weaker position.
# §6.4 — informed-decision is PEP-shaped: it causes a protected side effect on
# the far side of a decision (recording an approver entry against an approval
@ -160,7 +270,11 @@ binding_digest_relationship:
this linkage must be revisited before the widening ships — a fail-closed
consumer obeying a cyclic claim denies permanently.
# §5 applies to Staff. This is a browser-facing surface with no Tooling contact.
# §5 applies to Staff, and this repository is now Staff by ruling — so the line
# below is the §11 mechanical check landing on it directly rather than by
# analogy. It is a browser-facing surface with no Tooling contact, so the check
# is total with an empty map and this repository is CONFORMING on §5, not
# blocked-clean and not a declared gap.
tooling_contacts: []
# §11 — record non-Tooling clients so the check is total.
@ -202,6 +316,35 @@ evidence:
residual: compromised-surface-presents-x-attests-y
residual_closed: false
custody: same-bound-as-every-other-source # §16 decided: no stronger archive
# A10 (GH-DEC-2026-018 §5) — emission is marked, never inferred. This
# repository EMITS into the estate's evidence stream; audit-core holds
# custody, which is disjoint from emission and discharges nothing of this
# emitter's guarantee.
emission_guarantee_owed: true
event_classes:
- id: presentation
kind: load-bearing
classification: volume
note: >-
One per render. Classified volume by this repository, which is the
classification a conformance run is SUPPLIED and MUST NOT infer.
- id: disposition
kind: load-bearing
classification: rare
note: >-
The binding act. Rare and security-relevant: heartbeat AND
reconciliation, never rate monitoring alone — a quiet month of
dispositions is indistinguishable from suppression by rate.
- id: stance-application
kind: load-bearing
classification: rare
note: Fail-closed stance applied at a binding attempt. Same form as disposition.
emission_guarantee_status: not-yet-declarable
emission_guarantee_blocked_on: >-
The local transactional outbox (§9.4) and the cadence declaration are
designed (docs/evidence-path-design.md §5) and depend on audit-core's
AUDIT-WP-0009 T04/T06 and on sender registration. Declared as owed rather
than described as operating.
note: >-
GH-DEC-2026-012 states the residual is not closed in those words, and this
repository is not credited with closing it. Same disposition as