Stand up the Engine/PIP surface for MAT-WP-0001

Declare layer.yaml, add a Python engine over a local SQLite store,
and cover deterministic assessment, the §13 gap register, stance-map
inventory, claim guardrails, and the gate-house review path with tests.

Assistant: grok
Assistant-Session: 01a04ceb-150e-7e80-a542-ec8b1372e164

SCOPE.md

@@ -8,28 +8,32 @@
 
 ## One-liner
 
-Seeded NetKingdom Engine (PIP) for deterministic maturity assessment, the
-estate gap register, and capability readiness — declared in `INTENT.md`,
-not yet implemented.
+NetKingdom Engine (PIP) that computes a maturity level from declared
+criteria and submitted evidence, holds the estate gap register and PEP
+stance-map inventory, and emits levels only as claims.
 
 ---
 
 ## Current Responsibility
 
-`maturity-engine` currently owns the **declaration** of the Engine/PIP
-boundary assigned by NetKingdom Security Layer Model v0.7 §4 and restated
-in `INTENT.md`: graded progression against declared criteria and evidence,
-the gap register, and capability readiness.
+`maturity-engine` owns the Engine/PIP surface assigned by NetKingdom
+Security Layer Model v0.7 §4: graded progression, the gap register, and
+capability readiness. It declares that layer in `INTENT.md` frontmatter
+and in `layer.yaml`.
 
-It does **not** yet own a running engine, a store, an API, a register that
-can be queried, or a claim contract `access-engine` can consume. Statute
-§13 and §13.1 still hold the gap-register snapshot and the PEP stance-map
-inventory because this repository cannot store state.
+The current implementation is an in-process Python library and CLI over
+this PIP's own SQLite store. It registers ladders as data, accepts
+evidence with validity windows, computes a deterministic explainable
+level, records progression history (including demotion on expiry),
+serves the §13 gap-register snapshot, inventories PEP stance maps,
+answers readiness as pending / declared-gap / surface-exists, and
+emits a `maturity-level` claim. Assessment and register mutations are
+queued in a local outbox in the same transaction; nothing calls
+`audit-core` inside that transaction.
 
-This repository now **declares** itself Engine, role PIP, in `INTENT.md`
-frontmatter against security-layer-model v0.7 and companion v0.2. The
-machine-readable `layer.yaml` form, a total client account, and the
-engine surface itself are not yet evidenced here.
+It does **not** decide whether an actor may act. It does not compile a
+level into a registry. It does not author ladder criteria, observation,
+or actuation.
 
 ---
 
@@ -120,20 +124,29 @@ engine surface itself are not yet evidenced here.
 
 ## Current State
 
-- Status: seeded, not implemented
-- On disk: `INTENT.md` (v0.7-aligned declaration) and `README.md`
-- Layer declaration: `INTENT.md` frontmatter declares `layer: Engine`,
-  `role: PIP` against security-layer-model v0.7; `layer.yaml` and a
-  conformance check are not yet present
-- Engine surface: none — no API, store, tests, or runtime
-- Gap register: still the statute §13 snapshot
-- Stance-map inventory: still statute §13.1 (one published map, one absence)
-- Claim contract with `access-engine`: not written
-- Evidence emission: not present
-- Registered ladders: none
-- Layout conformance (ITC-REPO-LAYOUT 0.1.0-RC1): **minimal** once this
-  `SCOPE.md` exists; `history/` and `workplans/` are in use as defined,
-  `demand/` and `docs/` are not claimed
+- Status: engine surface present; production deploy is not claimed
+- Layer declaration: `INTENT.md` frontmatter and `layer.yaml` declare
+  `layer: Engine` / `role: PIP` against security-layer-model v0.7;
+  `scripts/check_layer_conformance.py` checks them
+- Runtime: Python package `maturity_engine` over SQLite (`make test` is
+  the documented command)
+- Assessment: named versioned ladders, evidence with expiry, deterministic
+  compute, explainability, progression history
+- Gap register: statute §13 snapshot is queryable here, with `state` and
+  owner-status intact; blocked-clean is not scored below conforming
+- Stance-map inventory: `ops-warden` published, `ops-mason` unpublished
+- Readiness: pending / declared-gap / surface-exists; actuation stays
+  pending and is not owned here
+- Claim contract: `docs/claim-contract.md`; guardrail tests reject a
+  registry compile and a consumer branch
+- Evidence emission: local outbox; load-bearing assessments; heartbeat
+  for rare classes; no synchronous `audit-core` dependency
+- Registered ladders: `asm` v0.3 (owner `gate-house`) and
+  `pep-stance-publication` v0.1 (owner `ops-warden`)
+- Review path: `Engine.review` / `maturity-engine review` computes and
+  remembers; it does not judge
+- Layout conformance (ITC-REPO-LAYOUT 0.1.0-RC1): **minimal**; `docs/`,
+  `history/`, and `workplans/` are in use; `demand/` is not claimed
 
 ---
 
@@ -148,9 +161,8 @@ Declared conformance: **`minimal`** under ITC-REPO-LAYOUT 0.1.0-RC1.
 
 Intentional omissions:
 
-- `demand/`, `docs/`, `research/`, `spec/`, `wiki/`, and `issues/` are not
-  currently claimed. They should be added only when their distinct semantics
-  are needed, not as empty structural decoration.
+- `docs/` holds the claim contract. `demand/`, `research/`, `spec/`,
+  `wiki/`, and `issues/` are not currently claimed.
 - Finished workplan archival, when it exists, will follow the Custodian
   ADR-001 convention at `workplans/archived/YYMMDD-...` so State Hub
   discovery remains deterministic.
@@ -178,17 +190,26 @@ Intentional omissions:
 - Operative form: `net-kingdom/SECURITY-COMPANION.md`
 - Alignment review:
   `history/260829-demand-netkingdom-security-layer-alignment.md`
+- Claim contract: `docs/claim-contract.md`
+- Layer declaration: `layer.yaml`
 - Active work: `workplans/`
+- Tests: `make test`
 
 ---
 
 ## Gap to Intent
 
-The seed declaration is in place. Nothing `INTENT.md` says this engine
-computes, remembers, or inventories is evidenced on disk yet. The work to
-close that gap is `MAT-WP-0001`, sourced from
-`history/260829-demand-netkingdom-security-layer-alignment.md`.
+`MAT-WP-0001` closed the seed-to-engine gap: a queryable Engine/PIP exists.
+Remaining aspiration, not a hole in this surface:
+
+- `gate-house` actually performing live conformance review through the
+  CLI rather than in tests;
+- ASM-0…ASM-6 assessed against a real estate with evidence fed by the
+  systems being assessed, not fixtures;
+- `access-engine` consuming the claim in a live decision record;
+- draining the local outbox into `audit-core` (the queue is here; the
+  drain adapter is not);
+- a production SQLite (or later catalogued) deployment.
 
 Do not host a PDP, compile a level into a registry, score blocked-clean
-below conforming, or treat observation or containment as available while
-closing it.
+below conforming, or treat observation or containment as available.