Stand up the Engine/PIP surface for MAT-WP-0001

Declare layer.yaml, add a Python engine over a local SQLite store,
and cover deterministic assessment, the §13 gap register, stance-map
inventory, claim guardrails, and the gate-house review path with tests.

Assistant: grok
Assistant-Session: 01a04ceb-150e-7e80-a542-ec8b1372e164

layer.yaml

@@ -0,0 +1,70 @@
+# maturity-engine — NetKingdom security layer declaration
+#
+# Framework: net-kingdom/canon/standards/security-layer-model_v0.7.md
+# Assent:    INTENT.md frontmatter (this repository's own voice, §11)
+# Validate:  python3 scripts/check_layer_conformance.py
+#
+# §11 requires a machine-readable declaration: prose cannot distinguish a
+# declaration from a transcribed review. Form adapted from ops-warden's
+# reference and kings-guard's no-contact Engine-adjacent shape.
+#
+# This repository is an Engine (PIP). Computing a level is not a protected
+# side effect, so there is no pep_stance path. Catalogued Tooling (OpenBao,
+# key-cape) is not contacted. Persistence is this PIP's own SQLite store.
+
+schema_version: "0.1"
+framework: netkingdom-security-layer-model
+standard_version: "0.7"
+repository: maturity-engine
+layer: engine
+role: pip
+declared_by: INTENT.md
+declared_at: "2026-08-29"
+
+# §4 catalog entry, transcribed so drift between the catalog and this file is
+# visible. The standard is authoritative for the row; this records what we
+# understand ourselves to have been assigned.
+catalog_entry:
+  owns:
+    - graded progression against declared criteria and evidence
+    - the gap register
+    - capability readiness
+  does_not_own:
+    - authorization decisions
+    - approval objects
+    - observation in production
+    - actuation / containment
+
+# §5 / §11: every direct contact with a Tooling-layer system (a §4 Tooling row).
+# Empty is a claim. This is an Engine API over state it owns, not Staff
+# reaching into OpenBao.
+tooling_contacts: []
+
+# §11 requires non-Tooling clients to be recorded so the check is total.
+# Neither target is a §4 Tooling row. Recorded, not policed as §5.
+non_tooling_clients:
+  - id: state-hub-work-records
+    target: state-hub
+    layer: not-catalogued
+    operation: "HTTP to the Custodian State Hub for work records and progress events"
+    write: true
+    note: >-
+      Outside §5 by the v0.5 scope rule: "Tooling-layer system" means a §4
+      Tooling row, and state-hub is not one. Carries no security authority
+      and no secret payload.
+  - id: sqlite-own-store
+    target: sqlite
+    layer: not-catalogued
+    operation: "this PIP's own transactional store (assessments, register, local outbox)"
+    write: true
+    note: >-
+      Engine-owned persistence, not Lifecycle over catalogued Tooling.
+      Consumers read claims through this engine's API, not by opening the
+      file. Listed so the client account is total. Review: 2027-02-28
+      (two intervals from 2026-08-29).
+
+# No PEP stance: this engine does not cause a protected side effect.
+declared_shapes:
+  "5.1": []
+  "5.2": []
+  "5.3": []