kings-guard/layer.yaml

# kings-guard — NetKingdom security layer declaration
#
# Framework: net-kingdom/canon/standards/security-layer-model_v0.7.md
# Assent:    decisions/decisions.md KG-DEC-2026-001 (kings-guard's own voice, §11)
# Validate:  python3 scripts/check_layer_conformance.py
#
# §11 (v0.7) requires a machine-readable declaration: prose cannot distinguish a
# declaration from a transcribed review. Form adapted from ops-warden's
# reference implementation, offered under §11.
#
# kings-guard's position is unusual and this file is shaped to state it exactly:
# there are NO Tooling contacts. Not a narrow one, not a read-only one. The
# capabilities that would need them sit at zero instead. Under §11 that is
# BLOCKED-CLEAN, which MUST NOT rank below conforming.
#
# OPEN — deliberately not resolved here (KG-IN-0007, commentary F3/F4):
#   * `layer: staff` below and `layer: Staff` in INTENT.md are both forms §11
#     permits, and §11 does not say which governs when both are present. Two
#     conforming conformance runs therefore disagree about this repository.
#     Neither file is being changed until gate-house rules precedence AND
#     whether the §3 vocabulary is case-sensitive; choosing here would be
#     kings-guard authoring a ruling it does not own.
#   * `standard_version` below names the version this declaration was VALIDATED
#     against, not the version of any assent — assents live in
#     decisions/decisions.md, each naming its own version. Whether a declaration
#     may carry a version at all is flex-auth's B4, also unruled.
# Assent to §9.5 at v0.8 is KG-DEC-2026-004 and does not move this file.

schema_version: "0.1"
framework: netkingdom-security-layer-model
standard_version: "0.7"
repository: kings-guard
layer: staff
declared_by: decisions/decisions.md#KG-DEC-2026-001
declared_at: "2026-08-29"

# §4 catalog entry, transcribed so drift between the catalog and this file is
# visible. The standard is authoritative for the row; this records what we
# understand ourselves to have been assigned.
# §3.4 — the four rules binding the agent principal. kings-guard offered to
# assent to these sight-unseen before they were written into v0.7.
agent_principal_rules:
  no_standing_credential: true
  tool_use_shapes: ["5.2-conduit", "engine-api"]
  memory_is_not_a_state_plane: true
  reconstructable_as_caller: true

# Honest split between what is mechanically checked and what remains an
# assertion. A claim in this file is not a test; the `form` column is.
agent_principal_rule_checks:
  no_standing_credential:
    form: test
    checked_by: scripts/check_layer_conformance.py
  tool_use_shapes:
    form: assertion
    note: >-
      No third route is claimed. The Tooling-client scan covers the Tooling
      half of "no third route". Distinguishing an Engine API call from an
      ordinary Python call is not mechanical here; remaining assertion.
  memory_is_not_a_state_plane:
    form: test
    checked_by: tests/test_immune_memory.py
  reconstructable_as_caller:
    form: mixed
    tested: EffectorRequest origin fields (KG-WP-0003-T06)
    remainder: >-
      Full reconstructability of every agent action as the caller's is still
      assertion; session and harness traces are glas-harness's.

catalog_entry:
  owns:
    - adaptive defence and judgment
    - observation of Staff-reachable sources
  pending:
    - identity observation
    - secret observation
  proposes_but_does_not_own:
    # §9.2 — actuation is an Engine concept held at zero. kings-guard proposes
    # containment and never performs it. This is not our gap to close.
    - containment

# §5 / §11: every direct contact with a Tooling-layer system (a §4 Tooling row),
# one entry each. Empty is a claim, and scripts/check_layer_conformance.py is
# what makes it checkable rather than asserted.
tooling_contacts: []

# §11 requires non-Tooling clients to be recorded "so the check is total".
non_tooling_clients:
  - id: state-hub-work-records
    target: state-hub
    layer: not-catalogued
    operation: "HTTP to the Custodian State Hub for work records and progress events"
    write: true
    note: >-
      Outside §5 by the v0.5 scope rule: "Tooling-layer system" means a §4
      Tooling row, and state-hub is not one. Recorded, not policed. Carries no
      security authority and no secret payload.

# §11 blocked-clean. These are NOT §5.3 declared gaps: there is no contact to
# declare. Fields follow the §5.3 shape so one register can hold both kinds
# (§13 now carries the state column that keeps them distinct — raised by
# kings-guard against v0.4).
unowned_capabilities:

  - id: authentication-assurance-evidence
    state: unowned-capability
    capability: >-
      Token assurance, attestation outcomes and authentication anomalies exposed
      as an engine surface, for identity-drift posture.
    intended_owner: "identity layer + audit-core"
    owner_status: "access-engine declined (v0.6 §13); reproposed, not assented"
    blocked_on: >-
      No engine exposes authentication evidence. key-cape is Tooling, so §5
      forbids the direct route, and the capability stays at zero rather than
      being taken locally.
    review: "2026-11-28"
    consequence: "identity-drift posture lane stays fixture-driven"

  - id: secret-use-evidence
    state: unowned-capability
    capability: >-
      Lease, revocation, mount and rotation metadata exposed as an engine
      surface, for secret-abuse posture.
    intended_owner: secrets-engine
    owner_status: "snapshot parsing admitted; posture admission pending"
    blocked_on: >-
      secrets-engine now exposes `secret-use snapshot`, a non-secret local
      evidence surface with a 1d heartbeat declaration. Envelope and scoped lane
      parsing are admitted under KG-WP-0006; event provenance, heartbeat evidence
      and posture admission remain pending under KG-IN-0005.
    review: "2026-11-28"
    consequence: "secret-abuse posture lane stays fixture-driven"

  - id: actuation-surface
    state: unowned-capability
    capability: >-
      Reduce authority, require step-up, isolate a workload — as a deterministic
      engine API carrying a decision record.
    intended_owner: "access-engine + runtime PEPs"
    owner_status: "proposed; access-engine has not reviewed (FLEX-DEC-2026-002)"
    blocked_on: >-
      Ruled in v0.6 §9.2 to be an Engine concept, unowned and held at zero.
      kings-guard proposes containment and does not own it, so this row is
      recorded here as a dependency, not as a kings-guard gap to close.
    review: "2026-11-28"
    consequence: "no containment is possible anywhere in the estate"

# §5.1 read-only diagnostic observation of Tooling: none declared, none taken.
# §5.2 conduit: none. kings-guard runs no tool under a caller's identity.
declared_shapes:
  "5.1": []
  "5.2": []
  "5.3": []